upvote
> You need some way to pass secrets to the app

Absolutely. This is why the env method is so attractive. It's simple and feels "free".

> doesn't every other way also suffer the same kind of issue

Not entirely. Accessibility (or dev ergonomics) and security are opposite ends of the same dial. As the other commenter wrote: a workload identity and a vault, and sharing the secrets between the two in a way that doesn't leave a plain-text trace for everyone to read (the environment is not private).

I like sops: https://github.com/getsops/sops

reply
Secrets should go in a vault and retrieved with the help of a workload identity.
reply
How does the running app instance get the workload identity?

The ways I can think of are (1) it's baked into the source code (worst possible security), (2) it's provided on the command line (also bad since command lines are visible to ps unless you do various OS-specific hijinks), (3) it's provided in an environment variable (no better than before), or (4) it's read from some well-known path (it seems to me that anything that could read a process's env vars could also read the contents of this file, so how is this more secure?)

reply
Now that we use coding agents, you don't want to store secrets anywhere in the same VM, because that makes them vulnerable to exfiltration. The best way is to access external services via a proxy that holds the secrets.

exe.dev has a zillion of them: https://exe.dev/docs/integrations

reply