It&#x27;s all chef-based so we could be using encrypted databags, but as anybody with access to the repo has root on the machines anyways, there&#x27;s little to gain there as well, especially given the very limited security implications. I&#x27;d be more worried that somebody adds his account to the sudoers list that stealing the secret data. But hey, things were that way when I joined and there&#x27;s better places to spend my time to improve security.