Comment by philbo

100% this.

1. Keep secrets in a dedicated secrets store.

2. Read directly from the secrets store in application code. There is no environment, there are no environment variables. Yes, even on local.