If your agent gets prompt-injected, can it leak your Stripe key? For most setups, yes. We wrote up the threat model and what a gateway-based vault actually covers.