I believe you can somewhat mitigate these concerns by reading and removing the secrets on startup, ideally whitelisting the entire env.