Secrets in environment variables are visible to the process list

Environment variables are the standard place to put configuration and they are readable by anything that can see the process — including, on many systems, other users.

# readable by the owner, and by root, and sometimes by everyone
cat /proc/1841/environ | tr '' 'n'

# and this is worse: visible in ps to every user on the box
mysql -u root -phunter2

The command-line case is the serious one and has a fix: mysql --defaults-extra-file, a .pgpass, or reading from stdin. For environment variables the mitigation is that the process should be the only thing on the host that matters, which is an argument for containers rather than a solution. A secret that must not be readable by a compromised application process needs a different mechanism entirely.