Handling sensitive configuration for marchat server

[Cod-e-Codes]

marchat client currently supports configuration via a config file (recommended) as well as command-line flags. The server supports both a JSON config file and command-line flags, giving users flexibility in how they configure the tool.

Since sensitive values like the admin key may be passed through either method, I want to ensure this approach balances security and usability effectively.

I’m interested in community feedback on best practices for managing sensitive data in config files or flags for CLI/server apps—especially in open source projects. Are there common pitfalls to avoid or improvements you’d suggest to keep things secure without sacrificing convenience?

Feel free to share your experiences or recommendations.

Thanks!