Comment by ypeter

And before this you could implement Cloud KMS in your app to decrypt the encrypted secrets you can store in your repo.