Static SECRETS_LOCATION 

pub(crate) static SECRETS_LOCATION: LazyLock<PathBuf>

Client secrets and cached OAuth tokens, kept out of CONFIG_LOCATION so they never show up via profile show or similar.