.secrets

# 3️⃣ Start the app (Docker compose will automatically read the file) docker compose up

: It often acts as a bridge to fetch keys from external managers like HashiCorp Vault about.gitlab.com 4. Local File Hiding

# .secrets.template DATABASE_PASSWORD=<your-local-password> API_KEY=<get-from-vault>

Even if you use a vault, the .secrets file has three insidious ways of leaking data.

: You must add .secrets to your .gitignore file to ensure it is never committed to version control. Scalable Alternatives: Moving Beyond Local Files