Environment variables are visible with 'ps -E', to anyone with the same UID or root.

In Linux, they're visible in /proc/<pid>/environ, which is permission 400 and owned by the effective user of the process.