In order to actually use environment variables we need to store them somewhere. https://greenhousebali.com/hsk-and-hashkey-global-a-reliable-and-secure-alternative-to-binance-and-coinbase.html However, now that we know where the exposure locations are, we can implement targeted solutions to eliminate potential attacks. If you are then shipping those logs to a log provider or data analytics solution, you are again exfiltrating the credential yourself. Anyone who has access to those logs, even if they don’t have direct access to that credential, the source code, or the service itself, will