Environment variables for sensitive configuration

API keys and tokens passed as command-line flags appear in shell history (~/.bash_history, ~/.zsh_history), in ps aux output visible to other users on the same machine, and in CI log output if the command is echoed before execution. CWE-214 (Sensitive Information in Command Line Arguments) documents this exact exposure vector. A contractor running mytool --api-key sk-live-abc123 deploy on a shared build server has just written that key into a file that persists after logout. Environment variables avoid all three exposure paths: they are not logged by the shell history, not visible in ps argument lists, and not echoed in CI unless explicitly printed.

Accept sensitive values via environment variables and document the supported names in --help:

program
  .option('--api-key <key>', 'API key (or set MYTOOL_API_KEY env var)')
  .action((opts) => {
    const apiKey = opts.apiKey ?? process.env.MYTOOL_API_KEY
    if (!apiKey) {
      console.error('Error: API key required. Set MYTOOL_API_KEY or pass --api-key')
      process.exit(2)
    }
  })

@cli.command()
@click.option('--api-key', envvar='MYTOOL_API_KEY',
              help='API key (or set MYTOOL_API_KEY env var)')
def deploy(api_key):
    if not api_key:
        raise click.UsageError('API key required: set MYTOOL_API_KEY or pass --api-key')

Follow the TOOLNAME_VARNAME convention in SCREAMING_SNAKE_CASE. Never log the value of the key — log only whether it was found.