[mjfisher]

Storing secrets in env vars is very common in practice, although it presents a slightly bigger attack surface than using something like Hashicorp's Vault to just pull the secrets into memory.

You can sometimes find debug pages etc for apps and runtimes set up that will show all set environment variables, or have crash monitoring software that will capture env vars and send them elsewhere by default. Those risks can be managed, but having sensitive information not set in the process environment is more 'secure by default'. It also means in the event that someone finds a way to remotely execute code in your process (eval() on an unsantized input, anyone?) it's much harder to dump out secrets.