You can get leaks from both env variables and from secret files. It might seem easier to get them out of env variables, but you’re really looking for a similar exploit vector.

The only way to really be secure is pretty complex: using a tool like Vault to rotate secrets, and that gets super annoying and you often have to write your tooling around your rotation tool.