Environment variables are the easiest way to get a secret into an application, which is exactly why so many teams outgrow them without noticing until an incident forces the question.
Where env vars fall short
- No audit trail. There's no record of who read the value or when — an env var, once set, is just... there.
- No native rotation. Rotating a secret stored as an env var means updating it in every place it's configured and redeploying every consumer — manually, unless you've built tooling around it.
- Easy to leak accidentally. Env vars show up in crash dumps, logging middleware that logs request context,
docker inspect, and process listings on some platforms. - No fine-grained access control. Anything that can read the process environment can read every variable in it — there's no way to scope access to just one secret.
What a secret manager adds
Dedicated secret managers (Vault, AWS Secrets Manager, GCP Secret Manager) address these gaps directly:
- Access is scoped and logged — every read is authenticated and auditable.
- Rotation can be automated — some integrations rotate database credentials on a schedule without any manual redeploy.
- Secrets are fetched at runtime, not baked into the deployment artifact or process environment permanently.
- Dynamic secrets — some secret managers can issue short-lived, unique credentials per request rather than a single long-lived static secret.
When plain env vars are still fine
For a small project, a single small team, and low-sensitivity secrets, the operational overhead of a full secret manager may not be worth it yet. The tradeoff shifts as team size grows, more services need access to the same secrets, or the secrets protect something genuinely sensitive (production database credentials, payment provider keys).
A middle ground
You don't need to choose all-or-nothing. A common pattern: use a secret manager as the source of truth, and inject values into the environment only at runtime via your platform's native integration (not committed to config files or baked into images) — getting some of the audit and rotation benefits without a full application-level rewrite.
The question isn't "are env vars bad" — it's whether your current setup gives you rotation and an audit trail for the secrets that actually matter. If not, that's the gap to close first.