> you‘re one `printenv` or improperly written third party dependency that leaks env vars away from a security incident.

Game over already if anyone can run commands or arbitrary code. Not using the environment won't help you.