My workflow is a wrapper script around restic primitives like check, backup, prune, whatever. The wrapper script pulls in the environment variables like account IDs and passwords (I use backblaze but they’re all very similar)…
I ran into an obscure (to me, anyway) one today, where the sourced env variables were dumped into a log that I sent to an ai model (of course, it’s 2026!) and it immediately flagged this as a key I needed to rotate – which is at least one very tiny positive sign that it’s watching for things like this.
This, in turn, got me to wondering if it’s possible (well, I know it’s “possible”… but is it reasonable/realistic) to implement the same kind of file indirection for the various backend authentication keys/passwords that we have for the restic repository password, where instead of passing the app an environment variable with the actual password, we instead pass it a filename where it can load directly?
My background is in networking and NOT in security, but at least from working through this stuff today I think this shrinks the vulnerability of an exposure significantly? I also think (but definitely do not know) that it would not be terribly difficult to implement?
Feel free to tell me if this is a stupid idea, but it seems like if it adds value and increases security for the repository file, it would do so equally for the backend authentication keys/secrets.
thanks as always for making a really incredibly awesome piece of software.