The problem isn't the tech, it's the people. If you allow these mistakes to be possible, they are inevitable. If you take basic precautions, you'll probably be

The problem isn't the tech, it's the people. If you allow these mistakes to be possible, they are inevitable. If you take basic precautions, you'll probably be fine. I'd rather take a well-curated and trimmed down .env over a poorly-configured secrets manager that gives away the entire farm when the single secret leaks. Security isn't a single thing nor bolstered by switching a single method of how you store your secrets. The problem is not taking precautions to prevent leaks from happening, not how you are managing your secrets. If your threat model begins or is imminently "when the attacker is logged in as root", just post your stuff on a public bucket to get it over with.