>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3401383. --> Reported by: [charginghawk](https://www.drupal.org/user/2626341) >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>After updating to Drupal 10, updating a config override in a settings.php file triggers an export that contains the override's value. Using a secrets.settings.php to store sensitive information is recommended by Acquia:</p> <p><a href="https://docs.acquia.com/resource/secrets/#secrets-settings-php-file">https://docs.acquia.com/resource/secrets/#secrets-settings-php-file</a></p> <p>And if you take that approach, then your secrets can potentially wind up wherever you have config_auto_export configured to send them. </p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <p>Have config_auto_export 2.1.6 running on Drupal 10.1.x, add a config override to a settings.php file, see that the override triggers an export which includes the override value.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Do not save values from settings.php files.</p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <p>TBD</p> <h3 id="summary-ui-changes">User interface changes</h3> <p>TBD</p> <h3 id="summary-api-changes">API changes</h3> <p>TBD</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>TBD</p> > Related issue: [Issue #2910353](https://www.drupal.org/node/2910353)