How do you protect secrets and limit the permissions of the app and the deployment process?

Every program should get only the access its work requires. A queue consumer doesn't need rights to all of the company's data. I don't store keys and passwords in the repo or paste them into a conversation with an agent. Using an environment variable alone doesn't close every way of leaking.

In CI/CD, i.e. automated checking and deployment, you can use a short-lived identity instead of a permanent key. You need to restrict which repos and runs can receive it. Untrusted code from a PR shouldn't get production secrets. A generated test is code too, and it can read or send something.