If these are params that should be shared among many stacks and even separate Pulumi programs, place them in a shared place (subscription, account, project, depending on your cloud of choice), using your cloud provider's secrets/parameter store, usually in the same space where your deployment pipeline lives.