[rasguanabana]

An alternative to just exporting a variable is to prepend it to the command. This will keep it unexported for subsequent calls in current shell.

var=value some_command

This will still show up in /proc, but a lot of internal tools often rely on environment variables, so it’s kind of inevitable.

[linuxhackerman]

This is indeed a useful approach to limiting the scope of environment variables, and I try to use that rather than exporting when possible. Using files (especially "special" files like the command-substitution fd reference) is still preferable by a wide margin, and I hope that applications trend towards using files as the primary mechanism for passing in secrets.