Cleartext Storage of Sensitive Information in an Environment Variable

Storing secrets in plain text within environment variables creates a broad attack surface. Many other processes within the same execution context can access these values, including child processes spawned by your application, third-party dependencies, and adjacent functions in serverless cloud environments. Since these components often don't actually need the secret, this practice unnecessarily exposes it. Furthermore, environment variable data can easily leak into unintended locations. Application code or logging libraries might inadvertently include these values in error messages, HTTP headers, debug outputs, or log files. This indirect exposure means that even if you don't directly read the variable in your core logic, a separate weakness elsewhere in your application stack could still disclose it.