# Refs only — real values live in ~/.creds (0600), never in repos. # Example: this repo's CLIs read env files at runtime, e.g. # docker run --rm --env-file ~/.creds/redmine.env ...