How do you incorporate secrets in this kind of implementation? Stored in db?

Secrets are orthogonal to durable execution--what are your concerns about using them together?

Unless you have a very specific use case, you wouldn't want to store in db or in any message you use in any workflow like this. Usually whatever does the actual work has a way to get the secret.