When API keys are involved, I need a lot more confidence in the security of the software than what I am seeing so far.

I'm willing to trust Datadog for configuring their own services, but the community providers scare me from a security perspective. What I can see from the early uploads are community providers accessing secrets manager to fetch API keys. What happens when a provider requests permissions for all secrets? How well will the UI surface broad permission grants? What if providers bake in "telemetry" to spy on me ?