Storing secrets in env variables

@goldbergyoni I started to investigate a bit into env variables, and a few people recommend to avoid storing secrets in env variables ([Source 1](https://stackoverflow.com/questions/65653000/why-is-it-safe-to-store-api-keys-in-digitaloceans-api-environment-variable-opt), [Source 2](https://security.stackexchange.com/questions/197784/is-it-unsafe-to-use-environmental-variables-for-secret-data)), cause packages could log `process.env` for debugging purpose or even send it to malicious server.
What are your thoughts about it?

Start by reviewing the two linked sources and the existing Node.js best-practices guidance; no file, test, or entry point is named. Determine whether the project should recommend an alternative to environment variables and what evidence supports that recommendation. Done means reaching a clear consensus and documenting the resulting guidance.

Written by the indexing model from the issue text.