Both stay on disk; the folder is already in .gitignore. They remain in git
history, so the DB password, service key, JWT secret and Stockfish key in them
should be rotated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>