[clord]

Env vars over-share and files depend on local permissions. We should have a capabilities -like way to send secrets between processes. e.g., decrypt and expose on a Unix socket with a sha filename that can only be read from once, and then gets torn down. Share the file name, target can read it and immediately the secret is now at-rest encrypted. Encryption based on config containing a whitelist of ssh public keys and what they can access, sort of like age.

[bhawks]

Yes and now we have to manage the identities of processes to ensure they are entitled to given capabilities.

Also any system as described needs security audit and analysis to truly understand it strengths and weaknesses (or glaring compromises).

Alternatively - secrets via environment vars weaknesses and mitigations are well understood.