Alternative to SRC_ACCESS_TOKEN if dotfiles are kept under version control?

[adamliter]

Is there a good alternative to specifying SRC_ACCESS_TOKEN in a dotfile, particularly if your dotfiles are kept under version control and pushed to a remote repository? Right now I'm doing this in my ~/.profile which works, but this means I am asked for my GPG password every time I start a new shell:

if command -v gopass 1>/dev/null 2>&1; then
    export SRC_ACCESS_TOKEN=$(gopass show sourcegraphcloud.com/token)
fi