I'm fond of the XDG path convention. Which basically boils down to putting configs in ~/.config/your_app/ and secrets in ~/.config/your_app/secrets.

If you use pydantic, it supports a secrets dir with a predefined path.

https://specifications.freedesktop.org/desktop-entry-spec/de...