"The environment" is not "environment variables" and not ".env files"

For cloud services, it would typically be called a vault. But it could also be a hardware security module (HSM) with bring-your-own-key (BYOK, eg for certificates.)

Ansible also calls it a vault and encrypts it with a password — that file you can check into version control.

▲

nebezb 6 hours ago | parent [-]

Confidently wrong. Did you read the source I linked?

> The twelve-factor app stores config in environment variables

	▲	dewey 5 hours ago \| parent [-]
		The vault of the cloud provider would just inject the value of the environment variable securely so it doesn't have to be stored on-disk. What the parent poster wrote isn't wrong.