Can config files in nodejs express be hacked?

I store my secrets (API key, password...) as plain text in my config files, and push it into a private repository in GitLab. It is not a best practice, I know, but I think it's quite hard to read these information. Unfortunately, some of my secrets are leaked lately. My questions are:

1. Can config files in nodejs express be hacked? I tried to navigate to config folder in web browser but get the 404 error.
2. How to secure config files in nodejs? I did a research and found 2 major solutions: to use environment variables and to encrypt/decrypt config files. Using environment variables seems to be easy to implement but in case of having a lot variables, this method is quite inconvenient. Is there any other solution? Which npm package is good for securing config files?