Yeah, there was a ton of wrong here. You captured much of the highlights.

I now understand why some developers tell me they think using environment variables for secrets is a bad idea.