It astounds me how many developers don't realize just how many places environment variables end up, even on a properly functioning server.

common info pages (ex: phpinfo), core dumps, debug errors and logs are notorious for containing them. And those aren't even counting the ways a malicious actor can persuade a program to provide them.