Why environment variables aren't a secrets manager

Names the real limitations of environment-variable secrets and walks HashiCorp Vault's authenticate-then-authorize architecture.