https://secretspec.dev/blog/secrets-dont-belong-in-config/