Asked about The shell and the server
How do you handle secrets on a server?
An answer that works
Environment variables injected by the platform or a secret manager, never committed files. A gitignored .env with restrictive permissions is acceptable locally and not in production.
Reading an answer is not being able to give one. The section that teaches this is The shell and the server, 6 hours of Linux & the shell.
Learn this properly