After updating to Drupal 10, updating a config override in a settings.php file triggers an export that contains the override's value. Using a secrets.settings.php to store sensitive information is recommended by Acquia:
https://docs.acquia.com/resource/secrets/#secrets-settings-php-file
And if you take that approach, then your secrets can potentially wind up wherever you have config_auto_export configured to send them.
Have config_auto_export 2.1.6 running on Drupal 10.1.x, add a config override to a settings.php file, see that the override triggers an export which includes the override value.
Do not save values from settings.php files.
TBD
TBD
TBD
TBD
Postponed: needs info
2.1
Code
Reading through the related issue, this sounds like an issue in Drupal core, or not? What would be required in this module to be changed?