---
id: infra/move-the-remaining-env-credentials-into-the
title: "Move the remaining env credentials into the secret store"
theme: infra
status: open
created: 2026-08-19
date_source: stated
order: 3
---

**Move the remaining env credentials into the secret store.** `putSecret`/`getSecret` and
`bun run secret:set` landed 2026-08-19, and notify now reads `apns-p8`, `apns-key-id`,
`apns-team-id`, `fcm-service-account` and `discord-webhook` from the store with env as a
fallback. Every other plugin credential is still env-only — same argument applies: bun
auto-loads `.env` into every PM2 process, so each one is readable from `/proc/<pid>/environ`
of twenty processes that have no business with it.