What do you mean by "injecting secrets into the environment"?

You mean a section in your app.yaml like this one:

    env_variables:
      DB_PASSWORD: "this is a secret"

As for as I know, in the Standard and Flex environments, app.yaml is the only way to define environment variables.