Using environment variables for everything is wrong too. API keys and other sensitive information should be in environment vars. Non-private information should definitely be in config files.<p>If you need the flexibility of environment variables for a semi-configurable non-secure variable, use them to overwrite a sensible default.