list or watch secrets cluster-wide, or in kube-system alone, and receive every Secret's data in the response.

Auto-created ServiceAccount token Secrets are gone from modern clusters, so what is harvested is whatever was deliberately stored.

That is the credential material the cluster actually runs on, including registry pull secrets, database and cloud credentials, TLS private keys, and any long-lived token created on purpose.

Revoking the permission afterwards does not undo the exposure.

Every credential returned stays valid until it is individually identified and rotated.