DMNO creator here - sensitive config values are able to be retrieved from a variety of backends using a flexible plugin system. We are certainly not telling you

DMNO creator here - sensitive config values are able to be retrieved from a variety of backends using a flexible plugin system. We are certainly not telling you that you have to use the encrypted file method, and depending on the security requirements of your project it may not be a good choice. You can also mix and match those plugins, and segment items however you see fit - so it's not always a single key being passed around. That said, it is a valid way that some folks use (see https://dotenvx.com/ https://dotenvx.com/, https://github.com/AGWA/git-crypt https://github.com/AGWA/git-crypt, https://github.com/getsops/sops https://github.com/getsops/sops) which can make sense for simpler projects with less stringent security needs. The bonus here is it does not require setting up, paying for, or integrating any external service, and helps save you from "secret sprawl". We have a plugin for 1password (which many teams are already using anyway) and have plugins planned for many other popular tools, including Infisical. Many other tools only really make sense for bigger enterprises, either due to cost, complexity, or both. Our goal here (or one of them anyway) is to make a tool that provides enough value to use in all cases, from very small and simple to very large and complex.