The most dangerous .env mistake is believing a deleted commit deletes a secret.
Short answer: commit .env.example, ignore .env, inject production values through a secret manager or deployment environment, and rotate any key that enters Git history—even a private repository.
.env
.env.*
!.env.example
| Safe habit | Why |
|---|---|
| Secret scanning in CI | Catches accidents early |
| Environment-scoped deploy secrets | Limits blast radius |
| Rotation on exposure | Makes old copies useless |
Masking a secret in CI logs is not access control. Do not pass credentials to untrusted pull-request code.
Treat secrets as revocable capabilities, not strings that happen to live in a file.
Cover photo by Stanislav Kondratiev on Pexels.