Good one!, as for app secrets, for dev I do store them in my config.py file but for production I prefer to use a secret manager, for instance the Google Cloud Secret manager to keep things as safe as possible.