1. the jar: src/main/resources/application-leaky.yml (a deliberately committed secret) as packaged
   $ unzip -p target/secrets-1.0.0.jar BOOT-INF/classes/application-leaky.yml | grep password
     password: hunter2-committed-to-git
2. command-line argument, as any user on the host sees it
   $ ps -o args= -p <pid> | tr ' ' '\n' | grep db.password
   --db.password=arg-secret-789
3. environment variables, readable by the same user
   $ tr '\0' '\n' < /proc/<pid>/environ | grep -E 'DB_PASSWORD_FROM_ENV|SIGNING_KEY'
   DB_PASSWORD_FROM_ENV=env-secret-123
   SIGNING_KEY=env-signing-key-456
4. /proc/<pid>/cmdline, what the kernel keeps of the arguments
   --db.password=arg-secret-789