8.11Important nuance: encryption isn't magic

MuleSoft's documentation makes an important point: decrypted values necessarily exist in application memory at runtime, so someone with sufficiently privileged OS/JVM access may be able to see them.

So security is not:

encrypted file
→ problem solved

You still need:

least privilege
deployment access controls
secret rotation
restricted logs
restricted Runtime Manager access