If it is private repo, I stored in repo.

But you can convert secret.json to base64 string and keep in Bitbucket secret, then convert back to file when use.