Why is a long-lived API token risky when stored directly in a service's process environment?
Process environments are runtime metadata that privileged inspection and diagnostic workflows may reveal.
The service can never read a value supplied through its environment.
Environment variables automatically encrypt the token with a unique key.
The token inherits mode 0600 from an unrelated file.
0600