Agreed to no hard coded secrets, disagree with storing them in clear text in environment variables unless they are stored encrypted. I have things like Azure tenant and subscription id in environment variables for ease of passing to scripts but no passwords other than some stored using SecureStrings in clixml files which are populated by code in my PS profile