I am working on a Java Spring Boot application and would like to follow a professional approach for managing secret credentials (such as database passwords, API keys, etc.).

I have the following questions:

If my configuration repository is hosted in Bitbucket, what is the recommended way to store sensitive credentials? Should they be encrypted, or should secrets be managed outside the Git repository?

What is the industry-standard approach for managing secrets in Spring Boot applications deployed across development, staging, and production environments?

If Config Server is used, how are secret credentials typically accessed securely by the Spring Boot application?

I am looking for best practices rather than project-specific implementation details. Any guidance or architecture recommendations would be appreciated.