I have a local file called ~/.zstuff that I load all ENV variables that is not supposed to be public like $GITHUB_TOKEN in it & I source this file inside my main .zshrc file. The $GITHUB_USER can be added to the same file or your normal .zshrc file since it not a senstive information.
The .zstuff Shoudn't be public or part of your .dotfiles repo.