Earlier quoted context omitted.
That would require no secrets. All it takes is a misclick into a .env file. I’d assume you’re not coding on a production system so your secrets shouldn’t be too hard to revoke, cycle them after your stream and any time you leak them.
Secrets should really be stored in services, not files outside of maybe a single bootstrap file (unless you're working on the secret storage service itself). I generate my secrets once, send them off to the secrets service, and then my service queries that service. I never see the secrets with my own eyes.
I've not come across what you describe