I’m ashamed to admit we have a discord channel for each project and we dump secrets there with access control to the channels based on who works on the project.

It’s peak startup opsec.