Comment by tptacek

It's pretty normal to keep secrets in a dedicated secret store, and then have the service launcher inject them from the secret store into the environment.