> Where should you put them? This is probably the crux of the issue. Environment variables are available on most systems where you might want to run software,

> Where should you put them? This is probably the crux of the issue. Environment variables are available on most systems where you might want to run software, containers included. For lots of configuration, they seemed to make sense: https://12factor.net/config https://12factor.net/config Of course, most container solutions (Docker, Kubernetes, Nomad) nowadays include solutions for managing secrets better, as do most cloud platforms, but they're not exactly as standardized or simple as environment variables are, maybe like a file mounted inside of the container that the app can read, at best. That said, I'm not excusing the fact that the vulnerability is caused by a package that lets you run phpinfo, since that does leak a lot of information - it's more like you need to be careful every step of the way, both with how you store and access your secrets, as well what you include with your code.