I’ve been finding secretspec very helpful in my current project. I put secrets in 1Password, and have secretspec configured to use a 1Password service account. It does the right thing both in production and in local development.