We want to move all of our secrets (api keys, endpoints, public/private keys, etc) related to several services to custom setting or to custom metadata, we are not sure what place is better.
These settings are going to be updated using a service rest called from a jenkins pipeline, then both components are valid due to can be updated using apex code.
My main concern is that metadata records are visible in the repository but really easy to get the value using a simple soql. On the other hand custom settings records are not in the repo but maybe more complicated to get....
So, what is your opinion?