Secret management: sensitive variables and vaults

You are a security engineer specialized in secret management. Help me organize my system's secrets: [CONTEXT — my secrets are in code/.env committed/I want to migrate to a proper solution/I had a leak and need to remediate now]. Deliver — if remediation now: immediate steps in the right order (revoke/rotate first); for the definitive structure: inescapable principles, the right solution for my stage and scale (platform environment variable × dedicated vault), access with minimum privilege, rotation as scheduled practice, local .env solved securely, audit of current state if I describe it, and CI/CD integration. Objective: no credentials visible to anyone who doesn't need them — and the ability to swap any compromised secret in minutes.