With latest (master) version of dotenv, you can load in sensitive information straight from the Mac OS X keychain.

.read_sensitive_data_into_environment

AWS_ACCESS_KEY_ID=$(keychain_account s3.amazonaws.com)
AWS_SECRET_ACCESS_KEY=$(keychain_password s3.amazonaws.com $AWS_ACCESS_KEY_ID)

keychain_account

#!/bin/sh

security 2>&1 find-internet-password -s $1 | ruby -ne 'puts $1 if $_ =~ /^\s*"acct"<blob>="(.+)"$/'

keychain_password

#!/bin/sh

security 2>&1 find-internet-password -s $1 -ga $2 | ruby -ne 'puts $1 if $_ =~ /^password: "(.+)"$/'