No one says your env vars need be unversioned. For instance, at SeatGeek we version all env vars in our chef cookbook repository as databags and reference them

No one says your env vars need be unversioned. For instance, at SeatGeek we version all env vars in our chef cookbook repository as databags and reference them in the application infrastructure. It does require more fancy footwork when deploying new features that need environment variables, but it also lets us share our codebase with non-technical users and the occasional freelancer/potential FT hire without needing to scrub confidential information.