I'm planning on upgrading from .env for secrets to python keyring everywhere (uses the OS's secret store, supports more backends via extras).
Processes with my credentials will still be able to read those secrets but the secrets are off the file system. Baby steps.