Everyone's hyping OpenClaw as the "secure-by-design" Terraform killer. I'm evaluating it for a new multi-cloud deployment.
I need to know how it *actually* handles secrets compared to Terraform's established patterns. Terraform's method is clunky but understood: state files are the main leak point, you use a backend with encryption, and you feed secrets via environment variables or a secrets manager.
OpenClaw's docs tout integrated secret management. What does that mean in practice?
* Are secrets still stored in plaintext in its state?
* Does it just bake in a hook for a vault, or is there a real abstraction?
* What's the provider support like for Azure Key Vault, AWS Secrets Manager, etc.?
* Most importantly, does their approach actually reduce the attack surface, or just move the plumbing around?
Give me the concrete, gritty details, not the marketing copy.
Caveat emptor.