I’ve been liking keeping sensitive config outside of the repo directory altogether, and instead putting it into a dotted folder in my home directory, so something like

~/.project-name/local.env

And then referring to that location in the repo, say from a docker compose file.

Works well so far