How should secrets be managed for serverless functions?
Never use plaintext environment variables for secrets. Instead, use a secrets manager like AWS Secrets Manager or Azure Key Vault and have your function pull the secret when it initializes. You can cache it in memory for that execution environment's lifetime, but this adds slight startup delay and requires managing secret rotation.