Build a small secrets loader in this working folder, and prove it in a trial folder with one made-up key in a protected settings file.
The loader reads the file only if it is private to me, and refuses with a clear message if others can read it. Every value it loaded is replaced by asterisks in what it logs. The file must be kept out of version control.
Use only the made-up key. Never ask me for a real one, never read a real settings file on this machine, and do not print the key in your summary.
Show me how I check it: it refuses when the file is too open, a log line shows asterisks instead of the key, and the key appears in exactly one place.
