.env File Security Best Practices: Keep Your Secrets Safe

Never commit .env files to version control. Instead, use a secrets manager like XtraSecurity, add .env to your .gitignore, use .env.example for templates, and rotate all secrets every 30 days. .env files stored in plaintext are the #1 source of leaked credentials in web applications.

Should You Commit .env Files?

The answer is simple: Never commit .env files to version control.

Even if you add it to .gitignore, mistakes happen. Developers accidentally commit the wrong file. CI/CD systems expose variables. The risk is too high.

Common .env Security Mistakes

Mistake #1: Committing .env to Git

git add .env  # 🚨 DO NOT DO THIS

Mistake #2: Hardcoding Secrets in Docker

ENV API_KEY="sk_prod_secret"  # 🚨 Visible in image

Mistake #3: Logging Environment Variables

console.log(process.env);  // 🚨 May expose secrets in logs

The Right Way to Manage .env Files

Step 1: Create .env.example

Create a template with placeholder values:

# .env.example
DATABASE_URL=postgres://user:password@localhost:5432/db
API_KEY=your_api_key_here
STRIPE_KEY=sk_test_xyz
JWT_SECRET=your_secret_here

Step 2: Add .env to .gitignore

# .gitignore
.env
.env.local
.env.*.local

Step 3: Use a Secrets Manager

For production, never use .env files. Use:

• XtraSecurity
• AWS Secrets Manager
• HashiCorp Vault
• Azure Key Vault

Step 4: Rotate Secrets Regularly

Change all secrets every:

• 30 days for database credentials
• 7 days for API keys
• Immediately if compromised

Implementation Examples

Development Setup

# 1. Create .env.local with your secrets

Docker Setup

FROM node:18

WORKDIR /app
COPY . .
RUN npm install

# Don't embed secrets in image
CMD ["npm", "start"]

Docker Compose with XtraSecurity

version: '3'
services:
  api:
    image: myapp:latest
    environment:
      DATABASE_URL: ${DATABASE_URL}
      API_KEY: ${API_KEY}

Red Flags in .env Files

Never include in .env:

• ❌ Production database passwords
• ❌ API keys for paid services
• ❌ OAuth tokens
• ❌ JWT secrets
• ❌ SSH keys
• ❌ Encryption keys

Securing .env Files

Use file permissions:

chmod 600 .env  # Only user can read

Conclusion

.env files are critical infrastructure. Treat them with the same security as production databases.