[awinter-py]

another question here is tools that want to write their secrets to files

(looking at you `gcloud`)

best practice I've heard is to create a user fs mount that prompts every time it's accessed?