.env Security Best Practices for Developers

.env Security

Environment variables need proper handling to stay secure.

The Golden Rules

• Never commit .env files

# .gitignore
.env
.env.local

• Provide a template

# .env.example (safe to commit)
DATABASE_URL=postgresql://localhost:5432/mydb
API_KEY=your_api_key_here

Common Mistakes

// ❌ WRONG: Exposing to client-side
const config = {
  apiKey: process.env.API_KEY  // Bundled in JS!
};
// ❌ WRONG: Logging secrets
console.log('Config:', process.env);

Production Best Practices

• Use a secrets manager (AWS Secrets Manager, Vault)
• Rotate secrets regularly
• Principle of least privilege
• Encrypt at rest