Its safety is proportional to your isolation model. Never use env vars for secrets when you’re executing arbitrary code, for example.