Ten years ago, in [2016-05-06-2] , I introduced a function called my-lisp-load. You write things like access tokens into files under ~/.emacs.d/spec/, and init.el loads them by file name. The goal back then was to keep credentials from leaking when publishing init.el on GitHub. Since spec/ isn’t tracked by git, it still serves that purpose today. However, “not tracked by git” and “not on disk” are two different things. The tokens in spec/ are stored in plaintext, so they’re defenseless against malware that grabs the whole ~/.emacs.d/ directory.