Env File

Your code will land on GitHub. A lot of GitHub is public. Bots read it for keys.

An env file is where the real values live so the repo can stay boring. .env holds DATABASE_URL, STRIPE_SECRET_KEY, the secret that would be a credit card in the commit. The code reads process.env.STRIPE_SECRET_KEY. The value stays on the machine — or in the host's secret store after deploy.

Same script, different room

Because the values sit outside the code, the same app runs everywhere. Your laptop gets test keys. A teammate gets theirs. Production gets the live ones. Nobody edits source to switch rooms. You switch the file.

The builder and the CLI already drop .env.example with the names and fake values. That file is safe to commit. It is a checklist. .env is the filled-in one. It is not.

The rule that ends careers for an afternoon

Never commit .env.

Add it to .gitignore on day one, before the first push. If an agent offers to "just paste the key in the route," say no. Point it at the env file. If you already pushed a key, rotate it. Do not hope. The bots are faster than your apology.

The leading dot hides the file in Finder. That is normal. It is not missing. It is trying not to be a screenshot you send a judge. Auth secrets, API keys, the database URL — all of them belong here, not in src/.

What this unlocks

Code can be public. Keys cannot.

Keep the names in git. Keep the values off it. That is the whole discipline.