To me, environment var seems more vulnerable, Open to all in plain and simple text data. Kinda Ready to cook.

But for this approach, my point is why we have to provide the actual password again while running the app!? The approach seems kinda weird to me.