You should use dedicated secret management utilities like Hashicorp Vault or Amazon KMS.

We are using git to store our configuration for each environment.

For instance, we have branch for each environment i.e dev, qa, etc and then we have a tag for each production release. Then we use cloud.spring.io/spring-cloud-config in our apps to read the configuration from git.

So far this is the best approach I have used in all the projects I have worked on.