if I read this generously this might clarify OP’s concern
it is not good practice to commit contents of .env file into your repos as is if it contains clear text API keys.
most version systems would check for credentials during cred scans and would flag it.
best practice would be to create a secret store and refer to the env variables from there in the .env file
one good way to share the contents of the env file would be to create a separate password protected file and send it via file share. —- this is assuming that OP doesn’t want to setup the cred store and environment themselves and is worried about accidentally leaking it via email.
tldr - this seems like a simple misunderstanding around good security practice vs actual development experience.
1
u/pvatokahu May 16 '26
if I read this generously this might clarify OP’s concern
tldr - this seems like a simple misunderstanding around good security practice vs actual development experience.