Well, I disagree. It doesn&#x27;t matter where you store them, repo or not: even if they&#x27;re not in a &quot;repo&quot;, they&#x27;re stored <i>somewhere</i>, and when you revoke access from someone to that somewhere, you still have the same problem: the party that you&#x27;re revoking access from <i>had</i> access at one point. For all you know, they copied the secret while they had access. You can&#x27;t &quot;revoke&quot; information from someone&#x27;s mind: you MUST rotate the secret to accomplish that.<p>If anything, I like the git repo idea b&#x2F;c — presuming that the repository stores a history of who had access to what, when — it removes the question of whether you need to rotate a secret. You can look at the history, and if the secret didn&#x27;t get rotated when access was removed or at some time afterwards, you know you&#x27;re not secure.<p>Compare that to say, a random file somewhere, say on a deployment node in deployment code, or alongside that code so as to keep it out of a repo, that just keeps the latest copy of the secrets, where one doesn&#x27;t know when access was revoked. Do the keys need rotation?