Best practice for managing secret credentials in Spring Boot using Bitbucket

I am working on a Java Spring Boot application and would like to follow a professional approach for managing secret credentials (such as database passwords, API keys, etc.). I have the following questions: If my configuration repository is hosted in Bitbucket, what is the recommended way to store sensitive credentials? Should they be encrypted, or should secrets be managed outside the Git repository?