Secrets vs config — where should you store secrets in a cloud setup?

Answer

Store secrets in a secret manager (or encrypted KMS-backed store) and inject them at runtime (env/volume), not in git or plain config files. Rotate secrets and follow least privilege.