If you need your developers to use legitimate secrets for local development, something is seriously wrong. External providers (say, payment integrators) that do

If you need your developers to use legitimate secrets for local development, something is seriously wrong. External providers (say, payment integrators) that don't offer integration/development keys and environments should be named and shamed until they provide that. And everything else? Create "harmless secrets" that can be used by your developers and where even a complete compromise of their machines, say as part of a supply chain attack, does not have the potential to cause a security issue. Put legitimate production keys into k8s secrets and expose these to containers (either natively via serviceaccounts, via secret files, or via environment variables), or into Docker containers, or if you're running bare metal, somewhere in /etc (or an NFS mount if you want to avoid dealing with secrets in Ansible). Deployment pipelines shouldn't ever touch any kind of credentials, they should all be provisioned out of band.