This is wrong and dangerous. From whom are you trying to keep these variables secret? Assuming a sane sysadmin, sensitive files would only be readable by the us

This is wrong and dangerous. From whom are you trying to keep these variables secret? Assuming a sane sysadmin, sensitive files would only be readable by the user which needs to run the application. And environment variables can be read from the procfs file system by the same user that launched them: http://serverfault.com/questions/66363/environment-variables-of-a-running-process-on-unix http://serverfault.com/questions/66363/environment-variables... Not to mention that if an attacker has shell access to your application user account, you're already owned. So again, who are you trying to hide these variables from? Because it seems like this is just security theater and additional inconvenience (why delete and recreate the file on each deploy?) for literally no benefit.