Version: 2026.1.24-3
OS: Linux (Pi 5)
Install: npm global

Steps to reproduce:

1. Create config with env var placeholder: "apiKey": "${NANOGPT_API_KEY}"
2. Run clawdbot gateway restart
3. Check config file - secrets are now written in plain text

Expected behavior:
Config file should remain unchanged with ${VAR_NAME} placeholders. Secrets should only be substituted in memory at runtime.

Actual behavior:
Config file is rewritten with actual secret values, exposing them in backups/version control.
Relevant docs: https://docs.molt.bot/gateway/configuration#env-var-substitution-in-config