- Don't put them in non-trivial paths so they are not easy targets. I never put them under a path that `git clean -xdf` erases, for example. - One thing that a

- Don't put them in non-trivial paths so they are not easy targets. I never put them under a path that `git clean -xdf` erases, for example. - One thing that always scares me is that some third party code will just do a getenv AWS_ACCESS_KEY_ID in whatever language and send it out somewhere. So I tend to either invent non trivial environment variables names, and/or do unsetenv when the process starts, after it loads them to some internal config struct.