commented:
What is "a narrowly scoped" environment variable in this context?

  commented:
I’m not sure, but it might mean an environment variable only set for
the process that needs it, rather than globally. Like this in Bash:
# narrowly scoped: myapp only
PASSWORD=hunter2 ./myapp

# widely scoped: the whole Bash process
export PASSWORD=hunter2
../myapp

# more widely scoped: the current Bash process and all future ones
echo 'export PASSWORD=hunter2' >> ~/.bashrc
exec bash # reload shell
../myapp

With that definition, narrowly scoped env var usage would be a
property of the secrets management process, not a property of the
secret-using program.

  commented:

widely scoped: the whole Bash process
export PASSWORD=hunter2

As hair splitting that usage does scope it for the whole bash process,
yes, but also for any subcommands that process spawns, as in
ONE=alpha
export TWO=beta
echo outer=$ONE
sh -c 'echo inner: one=$ONE two=$TWO'

produces
outer=alpha
inner: one= two=beta


  commented:
I agree with the basic premise of the article. I would only like to
offer additional restriction: secrets shouldn't be passed by
environmental variables. They are too easy to snoop in most common
configurations.
.