DEV Community

sozenka
sozenka

Posted on

Stop committing your .env file

#security #rust #devops #opensource

Secrets leak through git every day (especially for new coders and vibe coders): API keys, database URLs, cloud credentials. Most of them come from the same place: a .env file that was committed by accident, or a key pasted into a config “just for now.”

And deleting the commit doesn’t fix it. Once a secret has been pushed, assume it’s compromised.

Here are three habits that prevent it, from simplest to strictest.

1. Ignore it before it exists

Add .env to .gitignore on day one, before the file is created. Keep a .env.example with fake values so new contributors know which variables to set.

.env
*.env.local
Enter fullscreen mode Exit fullscreen mode

This stops most accidents, but it doesn’t solve sharing: people still end up sending the real .env over chat.

2. Encrypt the real file and commit the ciphertext

Commit an encrypted version of the file instead. Teammates get the secrets from the repo; GitHub only ever sees encrypted bytes.

Options:

  • SOPS: the most flexible. Works with age, PGP, AWS/GCP/Azure KMS, and can encrypt individual values inside YAML/JSON.
  • dotenvx: keypair-based encryption for .env files.
  • sealenv: a small Rust CLI I wrote for teams that want zero setup: 
sealenv init      # generates a key in ~/.sealenv/keys, updates .gitignore
sealenv encrypt   # .env -> .env.enc (AES-256-GCM)
git add .env.enc
Enter fullscreen mode Exit fullscreen mode

The key never touches the repo. Share it once with sealenv key export / key import.

  1. Never write plaintext to disk

The strictest option is to decrypt into memory and inject the variables straight into your process:

sealenv run -- npm start
# or: sops exec-env secrets.enc.env 'npm start'
# or: op run -- npm start     (1Password CLI)
Enter fullscreen mode Exit fullscreen mode

No .env file sits on disk to be picked up by a backup, an editor plugin, or a careless git add ..

Already leaked a key?

  1. Rotate it at the provider first. This is the step that matters.
  2. Then remove it from history (git filter-repo or BFG), and force-push.
  3. Check the provider’s logs for use of the old key.

Which tool?

  1. Small team, want it working in a minute: sealenv or dotenvx.
  2. Cloud KMS, compliance, or per-value YAML encryption: SOPS.
  3. Team already on 1Password: op run.

sealenv is open source (MIT): sealenv. If it’s useful to you, sponsoring keeps it maintained.

Top comments (0)