Divya

Anything genuinely secret goes behind your own endpoint. The app calls you, you call them.

On where they live: build profiles, and the reason a file feels fine locally is that development reads it from your machine, which the build machine has never seen.

Once you have that distinction the whole class of problem disappears, because you stop expecting a file that is not in the repository to arrive somewhere it was never sent.