I’m advocating people use something like SecretsManager, not this thing. In-memory only > env vars > secret files on disk.

I find env vars very precarious because harmless developer debug logging, actions like sshing into a container and typing `env` etc can easily expose them.

File on disk can be read by an attacker with via subdirectory path traversal bug

It’s much less likely for in process only secrets to be exposed by common mistakes/bugs