Git and GitHub for Scraper Projects

Which is the right way to keep secrets out of a scraper's git repo?

• ACommit them in a config.production.php file
• BRead from environment variables (loaded from a gitignored .env file), commit only a .env.example with dummy values to document the schema
• CEncode them in base64 before committing
• DPut them in .gitignore