[diogomonicapt]

We explicitly chose not to support secrets as ENV variables, since they are prone to being leaked (child processes inhering parent's env; easy to leak ps -e; bug reports usually include ENV of the application; core dumps include ENV of the application, etc etc)

[tlrobinson]

Makes sense, but how do child processes not have access to the secrets files?

[diogomonicapt]

My unstated assumption was that when calling something like imagetragick you would be doing the appropriate privilege dropping using setuid and setgid. This is obviously not necessarily the case, but it's at least a lot more common than people cleaning up the ENV before creating a child process.

[paulddraper]

They do. That point is less valid.