[deflator]

I've been having success using Doppler for secret storage. Takes it off the filesystem.

[xinbenlv]

My question is not about on or off storage, is more about when you give agent access, it assume the environment agent runs is safe