How secure is the use of "secret" import?

[DeaD_EyE]

The question in my opinion is still valid in that if you create a file within your system which contains "secrets" and your system has been hacked then there's a very good chance that your "secrets" are no longer "secret".

If a hacker has access to your System, then you've lost, and it doesn't matter where your credentials are saved.

Storing credentials in a file next to your source code, prevents accidentally uploading code with credentials included. This is why we use extra files for credentials.

You could try following:

• Make a small example project and upload it to github
  
• Then add credentials to your source code and push the change
  
• Then try anything, to get rid of the credentials in source code and it must not be visible in commits. Good luck.