I wouldn't put them on a filesystem; do you have any guarantees the secrets are wiped clean after your application is shut down? At least env vars are in memory (...I... think...?), and will be offloaded if the server shuts down.

A secrets manager may be a better option, these days. I don't believe they were a thing in 2011 though.

Also 2011 was 11 years ago, and I still keep this webpage in mind when building server-side software <_<.