3 ms·

.env files are a thing in tons of codebases

• iwontberude 10mo ago
  but thats at runtime, secrets are going to be deployed in a secure manner after the code is released
  • zwnow 10mo ago
    .env files are used to develop as well, for some things like PayPal u dont have to change the credentials, you just enable sandbox mode. If I had some LLM attached to my codebase, it would be able to read those credentials from the .env file. This has nothing to do with deployment. I never talked about deployment.
    • Carrok 10mo ago
      If you have your PayPal creds in your repository, you are doing it wrong.
      • zwnow 10mo ago
        .gitignore is a thing
        • Carrok 10mo ago
          Which every AI tool I’m aware of respects and ignores by default.
          • zwnow 10mo ago
            Why is it that they can add new env variables then?
            • Carrok 10mo ago
              It is trivial to append to files without reading them. Also, no AI provider even wants your secrets, they are a liability. Do whatever you want though, I'm not here to convince you of anything.
• mkozlows 10mo ago
  If your secrets are in your repo, you've probably already leaked them.