What is the best practice for secret manager? - Theo's Typesafe Cult