title: Vulnerability of environment variables
body: <p>I was trying to find the best way of utilising a config file in my projects, i.e. for reading in usernames, tokens, passwords etc. </p>
  
  <p>I began by just using a <code>config.json</code> and then parsing that in another file to access the parameters. Then I came across <a href="https://stackoverflow.com/questions/5869216/how-to-store-node-js-deployment-settings-configuration-files">this answer</a> using a <code>config.js</code> instead. 
  But this got me thinking about the way environment variables can be accessed. </p>
  
  <p>What is to stop some node package I download from grabbing my <code>process.env</code></p>
  
  <pre><code>config.twitter.password =  process.env.TWITTER_PASSWORD
  </code></pre>
  
  <p>and then firing off a HTTP request with it to some external database, thereby leaking any passwords/tokens I might have stored as environment variables?</p>
  
  <p>I have a feeling I'm being both naive and also missing something important, so I'd appreciate some instruction. Thanks.</p>