credential (systemd credential)

A secret systemd copies into the service at every start, declared as LoadCredential=database-url:/etc/credstore/database-url. The copy lands in /run/credentials/example-api.service: in memory, read-only, one file at mode 0400 that only root and the user in User= can open, with %d holding that path. It looks like a tidier Environment=, and that is the confusion worth ending: systemctl show example-api -p Environment hands the values themselves to any local account over the system bus, with no sudo and no trace, because systemd.exec(5) does not treat a unit's environment variables as data worth protecting. -p LoadCredential answers [unprintable]: that property never held anything but the id and the path. The price is real — the application must read a file rather than a variable — and the bare name LoadCredential=database-url makes a missing credential non-fatal, so the service starts with nothing under %d/.