Handling secrets inside toml config

[erictrometer]

Is there currently a way to handle secrets without exposing them directly inside the toml config files?
Declaring it like this seems rather insecure. I could not find any other ways in the doc? Tried .env injection into toml but the variables don't get parsed. Thanks for your suggestions.

[store."redis"]
type = "redis"
redis-type = "single"
urls = "redis://my_username:[email protected]#insecure"
timeout = "10s"

[erictrometer]

For some reason this does not pull the variable from the .env file:

secret = "%{env:ADMIN_SECRET}%"

Any thoughts on why?