Stop Putting Secrets in .env Files
Summary
This post identifies the risk of storing credentials in plaintext .env files and presents a simple, practical pattern to inject secrets at runtime from a secure vault (1Password or macOS Keychain). It includes concrete, code-based implementations and a demo repo, emphasizing a single source of truth, easier onboarding, and improved auditing. The approach is broadly applicable to small teams and personal projects, without requiring enterprise tooling.