A named value injected into a running process from outside the code — used to pass configuration, secrets, and environment-specific settings without hardcoding them.
Example: DATABASE_URL, API_KEY, NODE_ENV — read at runtime so the same build can run in dev, staging, and production with different behavior.
In practice: Secrets in environment variables are better than secrets in code, but env vars still end up in process listings and logs if you're not careful — proper secrets management eventually means a dedicated vault, not just env vars.