Environment Secrets
What are .env files?
.env files are used to store environment variables for applications. They typically contain configuration values and secrets that should not be hard-coded in source code:
APP_SECRET=a3f2b8c9d4e5f6...
JWT_SECRET=7b1c9d2e4f5a6b8c...
DATABASE_URL=postgres://user:pass@host/dbFrameworks like Django, Rails, Node.js, and many others support .env files natively or through libraries.
Why you should never commit secrets
Accidentally committing .env files to version control is one of the most common security mistakes:
- Secrets become permanently visible in git history, even if deleted later
- Public repositories expose secrets to the entire internet
- Automated scanners constantly search GitHub for leaked secrets
- Compromised secrets can lead to data breaches, unauthorized access, and financial loss
Always add .env to your .gitignore. Use secret management tools for production deployments.
Why rotation matters
Secret rotation means periodically replacing old secrets with new ones. This limits the damage if a secret is compromised:
- If a secret leaks, the window of exposure is limited
- Regular rotation reduces the value of stolen secrets
- Many compliance frameworks (SOC 2, PCI DSS) require regular rotation
Use the RandKit Env Secret Generator to quickly generate new secrets for your .env files — entirely in your browser, with no data sent to any server.