title: Is it secure to store passwords as environment variables (rather than as plain text) in config files?
body: <p>I work on a few apps in rails, django (and a little bit of php), and one of the things that I started doing in some of them is storing database and other passwords as environment variables  rather than plain text in certain config files (or in settings.py, for django apps).</p>
  
  <p>In discussing this with one of my collaborators, he suggested this is a poor practice - that perhaps this isn't as perfectly secure as it might at first seem.</p>
  
  <p>So, I would like to know - is this a secure practice? Is it more secure to store passwords as plain text in these files (making sure, of course, not to leave these files in public repos or anything)?</p>