[rustyminnow]

I think in the context of containers you're right, there's a level of isolation and secrets are probably fine. But I think under other contexts that lack that isolation (e.g. bare-metal processes, local dev tooling) there are extra concerns.

(inb4: container env-vars are isolated from other containers, not from processes on the host system)