Now that we use coding agents, you don't want to store secrets anywhere in the same VM, because that makes them vulnerable to exfiltration. The best way is to access external services via a proxy that holds the secrets.

exe.dev has a zillion of them: https://exe.dev/docs/integrations