I am working on a Gatsby app that implements some 3rd party APIs, all requiring personal credentials. Later on I'm planning to also add a DB, so that will require credentials as well. 
Since all my code is committed to GitHub, I'm looking for a way to store and access these in a secure way.

While I haven't deployed my app yet, the solution should apply to both local development as well as production.

I'd like to mention that I've never (had the chance to) worked with similar problems in that past, thus I don't even know where to look or what I'm supposed to look for to solve this.