No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

You could store them in vault or another provider like that and input reference by name as config

Then use the provider and get that value at runtime for that secret

<@UMBT6JBPT> I actually like them where they are - as secret env variables in Github.
I guess I can just use `process.env` to read them.

Then there are secrets generated by Pulumi, like RDS password. That’s fine, that can stay with Pulumi.
Out of curiosity, I don’t actually have to save the db, right? Pulumi does that for me when creating the RDS instance and each time I call pulumi up it will use said password for my Pod spec, right?

&gt; I guess I can just use `process.env` to read them. 
&gt; 
Yes this is a good option if you don’t want to use the Pulumi managed config.  You could also drop in your own file at runtime and read from it.

&gt; each time I call pulumi up it will use said password for my Pod spec, right? 
&gt; 
That’s correct.  Pulumi keeps track of the inputs for resources in the state file. Pulumi encrypts this in transit and at rest but there are options to manage that yourself. See: <https://www.pulumi.com/blog/managing-secrets-with-pulumi/|https://www.pulumi.com/blog/managing-secrets-with-pulumi/>.