Ask HN: How do you manage app secrets?

In a web application, there are so many secrets to be managed - db passwords, jwt secrets, session secrets, etc.. what's a good strategy to manage them? I don't imagine committing them to version control is a good idea?