Activity Spotlight

What's the best way to manage secrets in Open Source?

I need some help/advice/guidance. We have some "secrets" that I think need to be kept secret. In an SSR application, you need a few pieces of information from your identity provider such that you can verify and write the cookie. Now in the open-source world, many different folks work on your project and will need those secrets. So what's the best way to manage this? Tenants, apps, what?