Passwords in Environment= lines, API tokens in world-readable unit drop-ins, and EnvironmentFile=/etc/myapp. env that every process on the host can cat once it gets a shell — that pattern still shows up in homelab and production units alike. systemd has a better primitive: credentials .
Source: [Dev.to](https://dev.to/lyraalishaikh/stop-putting-secrets-in-environment-variables-practical-systemd-creds-on-linux-4gfi)