DO NOT USE SECRETS IN ENVIRONMENT VARIABLES. HERE'S HOW TO DO IT BETTER

Summary from the TLDR Web Dev newsletter

Storing secrets in environment variables is a common practice but actually may be a security risk when secrets are poorly managed, leaked through frontend code, exposed in .env files, logged unintentionally, or inherited by child processes. Developers should try to use secrets stores instead.