sure env vars are overused. some values simply do not belong in the environment, for example - credentials. however, i havent seen a more convenient method of injecting configuration dynamically without some error prone file watching mechanics
Why don't credentials belong in the environment? They're definitely not visible to other users there, as opposed to on the command line where they definitely are, or in a file where they can be if you don't set the permissions correctly.
Because with credentials in environment we now have to distinguish between private and public environment vars so we don’t accidentally log something we should not or expose security sensitive info in another way