A reference to a consumer-held secret — never the secret itself.

The cast rejects any value carrying a live secret's shape (whsec_ / whsk_ / whpk_ prefix, the Standard Webhooks secret encodings): a literal pasted into an endpoint row is the exact leak ADR-0005's callback-only rule exists to prevent, and because the rejection lives in the TYPE it holds on every write path — the package's actions, and any consumer-defined create/update that accepts the attribute.