Hmm I think it's nothing to do with secrets provider, more that I've set somewhere a ConfigValue(null) which is accepted but blows up at a later point.