Ask HN: How are people storing user-scale secrets?

Like when you capture an oauth key, or some other 'password-like thing' that you need to store per-user and need to retrieve in plaintext so you can access an external service. Are you just putting this in a DB? AES-ing it?

My goal is to not leak oauth access when my DB inevitably gets stolen.