Inject secrets at runtime instead of baking them into builds

Environment variables are a fine way to hand a secret to a process, as long as the value is supplied when the app starts, not compiled into an artifact. Secrets inside a Docker image, a mobile app binary or a frontend bundle can be extracted by anyone who gets the artifact.

The pattern is simple:

1. Build once, with no secrets in the build.
2. Supply secrets per environment at deploy time, from your secret store.
3. Run the same artifact in staging and production with different values.

For containers, prefer secrets mounted as files. Docker and Kubernetes both support this, and mounted files do not show up in docker inspect or process listings the way environment variables can.

Verify by searching a built artifact for a known secret value, for example with grep -r over an unpacked image or build folder. It should not be there.