How secure is the use of "secret" import?

[buran]

Not storing hardcoded credentials within your code IS (or should be) common knowledge, if not for other reason, then because you don't want to store credentials and push them in the repo. Naming a file "secrets" is really not that common IMHO and more a matter of personal choice.

Your description as

the "secrets" file

was unclear, although I guessed you mean exactly that.