The idea is to gate automatic secret replacement to specific hosts that would use them legitimately to avoid exfiltration.