Environment-specific configuration with Rails credentials

Storing secrets in environment variables works but gets messy at scale with dozens of keys. Rails encrypted credentials provide a structured alternative where secrets live in version-controlled credentials.yml.enc files, encrypted with a master key stored outside the repo. I can have environment-specific credentials like credentials/production.yml.enc that override shared defaults. The rails credentials:edit command decrypts, opens an editor, and re-encrypts on save. This approach keeps sensitive configuration centralized and auditable while preventing accidental commits of plaintext secrets. The master key must be injected at deploy time via RAILS_MASTER_KEY env var or config/master.key file. I organize credentials hierarchically with namespaces for each service.