It says encrypted. Is it?

Start with the evidence, not the comment. Look at the value itself.

learner@crypto-lab:~/encoding$ cat app.conf
[reports]
host = reports.fernhill.example
user = svc_reports
secret = ZmVybmhpbGwtcmVwb3J0cy1wcm9k
note = the secret above is encrypted, safe to share

you should see A value made only of letters, digits and maybe +, / or = at the end.

Base64 uses 64 characters and pads with =. Real ciphertext is binary and usually looks like garbage or arrives as base64 of random bytes, which is longer and has no readable shape when decoded.

learner@crypto-lab:~/encoding$ awk '/^secret/ {print $3}' app.conf
ZmVybmhpbGwtcmVwb3J0cy1wcm9k
learner@crypto-lab:~/encoding$ awk '/^secret/ {print $3}' app.conf | wc -c
29

you should see 28 characters plus the newline. A length that is a multiple of 4 is another base64 hint.

Decoding needs no key. If you can do it in one command, so can anyone who reads the repository.

learner@crypto-lab:~/encoding$ awk '/^secret/ {print $3}' app.conf | base64 -d; echo
fernhill-reports-prod

you should see A readable production secret.

defender tip Search repositories and tickets for long base64 strings during reviews. grep -rEo '[A-Za-z0-9+/]{20,}={0,2}' finds candidates fast.

Encode the plain value yourself. Getting the same string back proves there is no key and no secret involved.

learner@crypto-lab:~/encoding$ printf 'fernhill-reports-prod' | base64
ZmVybmhpbGwtcmVwb3J0cy1wcm9k

defender tip Use printf or echo -n. A plain echo adds a newline, which changes the output.