Build logs are the most-read documents in an engineering organization and the least protected. Here is how credentials end up in them, and the three changes that stopped it for us.