There are tons of debates online about this. Realistically I think it's all tradeoffs and there are no silver bullets, so I won't really weigh in on the _right_

There are tons of debates online about this. Realistically I think it's all tradeoffs and there are no silver bullets, so I won't really weigh in on the _right_ way to do it. But I think we can all agree that MANY people are using env vars for secrets because of their simplicity, so our hope is to help make those folks more secure and solve some of the related papercuts. Ultimately DMNO is designed in a way that we should be able to swap out how the config actually gets passed around, so we can hopefully help users use whatever is the most secure way to do things without having to think too much about it.