I've always used a mix of environment variables and a set of config files for my apps. Often the vars determine which config files are loaded, which mode the ap

I've always used a mix of environment variables and a set of config files for my apps. Often the vars determine which config files are loaded, which mode the app operates in (expert,normal,beginner), and debug level. I never put security information in the env variables. I also always treat vars as unvalidated user input (i.e., apply sanitization and validation).