> it's people leaving .env in git Ah, makes sense it could get exposed then. The pattern I've always followed is having `.env.template`, `.env.dev` or similar

> it's people leaving .env in git Ah, makes sense it could get exposed then. The pattern I've always followed is having `.env.template`, `.env.dev` or similar in SCM, then require the development setup to manually/automatically copy it to `.env`, which is .gitignore'd. Seems that pattern might not have been as widespread as I thought :)