Protecting plaintext secrets in configuration files