How did the script know where to write data and which credentials to use? Was that hard‑coded in the code or stored in variables?

The script determines its output location and credentials through a combination of configuration files and environment variables. In production, we avoid hard‑coding paths or secrets in the source code. Instead, we use a YAML or JSON config file that contains placeholders for the destination bucket, table name, and other parameters. At runtime, the script reads this config and resolves the placeholders using environment variables or a secrets manager. For credentials, we rely on the platform’s IAM roles or a secrets service such as AWS Secrets Manager or HashiCorp Vault. The script pulls the secret at startup, decrypts it, and uses it to authenticate to the target service. This approach keeps sensitive data out of the codebase, allows different environments (dev, staging, prod) to use distinct credentials, and simplifies rotation. If a variable is missing, the script fails fast with a clear error message, preventing accidental writes to the wrong location.