I put mine in various aes encrypted file (like `~/.secrets.aes`) and then source it explicitly when needed with:

    . <(aescrypt -d -o - ~/.secrets.aes)
I have a handful of aliases/functions to make it more smooth, but that's the core.

Where are those aliases stored?

In that AES encrypted file.

It's a shellscript that they encrypted. They decrypt it and feed the decrypted output immediately into the shell, to be sourced.

That encrypted secrets file could contain any shellscript, so the aliases are stored in there, together with the API-Keys and passwords.