Please keep in mind this point called out by wereHamster elsewhere (
https://news.ycombinator.com/item?id=8695887 ):
> env variables are inherited by children, which may be relevant if the app forks
If your app forks (or any of the multitude of libraries that it may depend on, check and _pin_ your sources (so they don't add un-audited behaviors)), whatever process it execs probably will get a copy of the environment of your process.
Yes, it's possible to clean the environment between the fork and the exec/execve. Do all / most frameworks do so or make it easy to do so? I'm not sure, but would check before making any assumptions about it.
I was about to suggest that sensitive information like credentials would better be kept in files that are referred to by name in command line arguments, but... unprivileged users cannot fork/exec a process as a different user, so children could read all the same files as the parent.
I can hardly believe it, but a plug for my masters work [0] is actually relevant here. I was interested at the time in the intersection of HCI and security, so I made up this thing called sub-identities that let unprivileged unix users create sub-users. It's a really watered-down version of some actual research that's been around for a while, but the point was, it was easy(ish) for the average unix user to use. I don't pretend that it was anything but a toy, though.
All that said, it seems that passing sensitive information in environment variables, squirreling them away in the process space somewhere, then cleaning the environment (all right away, during initialization) would be a smart thing to do.
edit: see `man 3 unsetenv` for how to do this
[0] http://ccl.cse.nd.edu/research/pubs/snowberger-thesis.pdf