Stop committing your .env file

sozenka — Fri, 16 Oct 2026 00:16:04 +0000

Secrets leak through git every day (especially for new coders and vibe coders): API keys, database URLs, cloud credentials. Most of them come from the same place: a .env file that was committed by accident, or a key pasted into a config “just for now.”

And deleting the commit doesn’t fix it. Once a secret has been pushed, assume it’s compromised.

Here are three habits that prevent it, from simplest to strictest.

1. Ignore it before it exists

Add .env to .gitignore on day one, before the file is created. Keep a .env.example with fake values so new contributors know which variables to set.

.env
*.env.local

This stops most accidents, but it doesn’t solve sharing: people still end up sending the real .env over chat.

2. Encrypt the real file and commit the ciphertext

Commit an encrypted version of the file instead. Teammates get the secrets from the repo; GitHub only ever sees encrypted bytes.

Options:

SOPS: the most flexible. Works with age, PGP, AWS/GCP/Azure KMS, and can encrypt individual values inside YAML/JSON.
dotenvx: keypair-based encryption for .env files.
sealenv: a small Rust CLI I wrote for teams that want zero setup:

sealenv init      # generates a key in ~/.sealenv/keys, updates .gitignore
sealenv encrypt   # .env -> .env.enc (AES-256-GCM)
git add .env.enc

The key never touches the repo. Share it once with sealenv key export / key import.

Never write plaintext to disk

The strictest option is to decrypt into memory and inject the variables straight into your process:

sealenv run -- npm start
# or: sops exec-env secrets.enc.env 'npm start'
# or: op run -- npm start     (1Password CLI)

No .env file sits on disk to be picked up by a backup, an editor plugin, or a careless git add ..

Already leaked a key?

Rotate it at the provider first. This is the step that matters.
Then remove it from history (git filter-repo or BFG), and force-push.
Check the provider’s logs for use of the old key.

Which tool?

Small team, want it working in a minute: sealenv or dotenvx.
Cloud KMS, compliance, or per-value YAML encryption: SOPS.
Team already on 1Password: op run.

sealenv is open source (MIT): sealenv. If it’s useful to you, sponsoring keeps it maintained.

DEV Community: sozenka

Stop committing your .env file

1. Ignore it before it exists

2. Encrypt the real file and commit the ciphertext