Configures Rails to load credentials master and environment key files from an out-of-band location (XDG on Linux/macOS, AppData on Windows) instead of the project directory. This reduces the risk of key exposure from tooling that reads or executes within your repo, including modern AI assistants and agentic tools.