How should secrets be handled in a pipeline?

Never commit them. Store them in a secrets manager (Vault, AWS Secrets Manager, CI secret store), inject at runtime as masked variables, scope them per environment, rotate regularly and scan repos for leaks.