Small teams often either do nothing — secrets in a shared document, or worse, committed to the repo — or jump straight to running a full secrets management platform they don't yet have the operational maturity to maintain. Neither is the right starting point.
What actually matters early: secrets out of source control and out of shared documents, no exceptions. Access scoped per-service rather than one shared credential set everyone has. And rotation that's at least possible without a deployment freeze, even if it's not automatic yet.
A managed secrets service from your cloud provider covers most of this without requiring you to operate anything new. Save the full self-hosted vault setup for when you have a specific requirement it solves — dynamic credentials, cross-cloud access — not as a default starting point.