Use bun secrets API https://bun.com/docs/runtime/secrets for storing API keys. The rest of the config should still be saved in the config file.