[stickfigure]

There are a million ways to do it that don't require Google? Your CI system builds the production image, it can get secrets from anywhere.

[bastawhiz]

My CI system arguably shouldn't have access to production secrets any more than my developers' macbooks.