Is there a case where providing sensitive info via cmd args or env vars is safer than storing them in files and using a cmd to read them? AFAIK, if one can read files on linux, they can read all of a process's args & env vars from /proc/$PID/{cmdline,environ}
, so files are pretty much always safer, at least on linux.