The Nix store is world-readable. Storing plaintext secrets in the Nix store is absolutely insane and foolish. Who does this?
Either don't store your secrets this way or don't use Nix. Please.
Either don't store your secrets this way or don't use Nix. Please.
/nix/store isn't world-readable. It's machine-readable, and most machines are single-user. I'll explain the caveats, but I can't tell them never to put secrets there; the predictable outcome then is they won't try nixos.