Deleting an API Key From Your Profile Doesn't Kill It in Running Processes

A developer discovered that deleting three API keys from their shell profile and verifying the change with a clean-room shell test did not actually revoke access for already-running processes. A long-lived editor process that had launched days earlier had frozen the old environment variables at startup and continued injecting them into every child process it spawned, including a reconnected review tool that authenticated successfully with the supposedly deleted key. This exposed a critical distinction between editing a config file on disk and having that change take effect in live processes. The env -i verification command only tests newly spawned shells and cannot detect stale values held in memory by existing parent processes. The author concluded that confirming a config fix requires checking three separate things: the file on disk, the environment frozen in any long-lived parent process, and the inherited environment of each child process spawned from that parent.