This is similar to how Rails handles secrets - https://edgeguides.rubyonrails.org/security.html#environment...
In Rails, the entire file is encrypted unlike here where only the secrets are
In Rails, the entire file is encrypted unlike here where only the secrets are