[victorbuilds]

I keep them in env variables rather than files. Not 100% secure - technically Claude Code could still run printenv - but it's never tried. The main thing is it won't stumble into them while reading config files or grepping around.

[63stack]

A process does not need to run printenv to see environment variables, they are literally part of the environment it runs in.

[dist-epoch]

The LLM doesn't have direct access to the process env unless the harness forwards it (and it doesn't)