Secrets, Credentials, and Process-Table Exposure

1. Secrets leak through more channels than stdout

Credentials can appear in process arguments, environment variables, shell history, xtrace output, temporary files, core dumps, CI logs, diagnostic bundles, or inherited child environments.

flowchart TD
  S["secret"] --> A["argv"]
  S --> E["environment"]
  S --> F["files"]
  S --> L["logs / traces"]
  S --> H["history / debug bundles"]

2. Command-line arguments can be observable

# Risky pattern:
# some_cli --token "$API_TOKEN"

# Prefer a supported stdin/file/provider mechanism:
printf '%s' "$API_TOKEN" |
some_cli login --token-stdin

On many systems, process arguments may be visible to other users, monitoring agents, or diagnostic tools.

3. Environment variables are convenient, not invisible

export API_TOKEN
run_child_process

Child processes inherit exported environment variables. Depending on OS and permissions, process environments may also be inspectable. Scope secret-bearing variables to the smallest command possible.

4. Prefer narrow command-scoped environment injection

API_TOKEN="$API_TOKEN" \
DEPLOY_ENV=prod \
./deploy-helper.sh

Avoid exporting credentials globally when only one subprocess needs them.

5. Disable tracing before secret expansion

set +x
response=$(secure_login "$API_TOKEN")
status=$?
set -x

6. Secret files require restrictive permissions

umask 077
credential_file=$(mktemp) || exit 1
trap 'rm -f -- "$credential_file"' EXIT

printf '%s\n' "$PRIVATE_KEY" > "$credential_file"
chmod 0600 -- "$credential_file"

7. Interactive history is another risk

Avoid typing long-lived secrets directly into interactive command lines. Prefer credential helpers, protected prompts, files with correct permissions, or short-lived identity mechanisms.

8. Log state, not secret value

if [[ -n ${API_TOKEN:-} ]]; then
  printf 'api_token=present\n' >&2
else
  printf 'api_token=missing\n' >&2
  exit 65
fi

Do not log hashes or lengths unless they are genuinely needed; even derived metadata can reveal information.

9. Short-lived credentials reduce blast radius

Workload identity, federated identity, instance roles, managed identities, and short-lived tokens are generally preferable to static secrets embedded in files or project settings.

10. Cleanup cannot revoke an already-exposed secret

Deleting a temporary credential file is necessary hygiene, but once a secret appears in logs or leaves the trust boundary, rotation or revocation is the recovery action.

11. Hands-on lab: compare secret scopes

mkdir -p "$HOME/devops-academy/bash/chapter18/lesson02"
cd "$HOME/devops-academy/bash/chapter18/lesson02"

cat > inspect-env.sh <<'EOF'
#!/usr/bin/env bash
set -u

if [[ -n ${DEMO_SECRET:-} ]]; then
  printf 'child_secret=present\n'
else
  printf 'child_secret=missing\n'
fi
EOF
chmod u+x inspect-env.sh

DEMO_SECRET='temporary-value' ./inspect-env.sh

printf 'parent_exported=%s\n' \
  "$([[ -v DEMO_SECRET ]] && printf yes || printf no)"

12. Knowledge check

13. Summary

Secret-safe Bash minimizes lifetime, scope, copies, and observability. Prefer supported credential providers, avoid argv and logs, scope environment variables narrowly, protect temporary files, disable tracing, and rotate credentials after exposure.

14. Further reading

• OWASP Secrets Management Cheat Sheet.
• OWASP Logging Cheat Sheet.
• GNU Bash Reference Manual — environment and tracing.
• Your operating system documentation for process inspection permissions.