# Env File (/academy/env)



Your code will land on [GitHub](/academy/github). A lot of GitHub is public. Bots read it for keys.

An **env file** is where the real values live so the repo can stay boring. `.env` holds `DATABASE_URL`, `STRIPE_SECRET_KEY`, the [secret](/academy/secret) that would be a credit card in the commit. The code reads `process.env.STRIPE_SECRET_KEY`. The value stays on the machine — or in the host's secret store after [deploy](/academy/deploy).

**Same script, different room**

Because the values sit outside the code, the same app runs everywhere. Your laptop gets test keys. A teammate gets theirs. Production gets the live ones. Nobody edits source to switch rooms. You switch the file.

The [builder](/builder) and the [CLI](/academy/cli) already drop `.env.example` with the *names* and fake values. That file is safe to commit. It is a checklist. `.env` is the filled-in one. It is not.

**The rule that ends careers for an afternoon**

> Never commit `.env`.

Add it to `.gitignore` on day one, before the first push. If an [agent](/academy/agent) offers to "just paste the key in the route," say no. Point it at the env file. If you already pushed a key, rotate it. Do not hope. The bots are faster than your apology.

The leading dot hides the file in Finder. That is normal. It is not missing. It is trying not to be a screenshot you send a judge. [Auth](/academy/auth) secrets, [API](/academy/api) keys, the database URL — all of them belong here, not in `src/`.

**What this unlocks**

Code can be public. Keys cannot.

Keep the names in git. Keep the values off it. That is the whole discipline.