I suppose I'm spoiled by the Symfony framework which has a robust Secrets Component [0].
It allows you to generate a public/private key for each environment: test, dev, and prod (by default). The 'prod' private key can't be committed to the repository. Once the cryptographic keys are generated, you can encrypt any secret you want, and the framework will automatically decrypt it and allow you to access it as an environment variable at runtime.
The encrypted values for all environments are committed to the repository. For example, the file for the `$STRIPE_SECRET_KEY` environment variable for the 'dev' environment is a file that has these contents (shortened for readability):
<?php // dev.STRIPE_SECRET_KEY.c33678
return "\x1Dq\x11B6\x5B\xFE7\x9B\xA4\xFE...";
1. Keys for the 'dev' and 'test' environments can easily be shared with the team because their public and private keys values are committed to the repository. No more sharing secrets file over Slack or through some other mechanism.
2. The private key for the 'prod' environment can be stored in a 3rd party vault so it can be made available to the production servers. You can also decrypt 'prod' secrets during deployment to reduce the decryption overhead for each request.
3. At worst, agents would have access to the secrets in the 'test' and 'dev' environments only because they couldn't decrypt 'prod' values locally.
4. It forces good practices to ensure you're not using the same secret value for production and non-production environments.
It's made secret management so easy I don't even give it a second thought. Do other web frameworks support a system like this?
[0] https://symfony.com/doc/current/configuration/secrets.html