Using environment variables to store sensitive information is a well-known bad practice that seems to be ignored by the "the twelve factor app" manifesto. We will dissect on why this is a bad practice, and why it is not a solution for the problems it tries to solve.