What is a .env file and why should it never be committed?

If you've worked with Node.js, Python or Laravel projects, you've seen a file named .env. This simple file is one of the most common sources of real-world credential leaks — I ran into the problem myself while reviewing one of my own projects (the story).

What is .env?

A plain text file holding environment-specific settings as name=value pairs:

DATABASE_URL=file:./data.db
JWT_SECRET=a-long-random-string
SMS_API_KEY=your-sms-service-key

The app reads it at startup and exposes the values as environment variables. That keeps secrets out of the code and lets each environment (development, test, production) get different values.

Why must it never be published?

Because it usually contains things anyone could abuse: API keys, database passwords, token-signing secrets. If .env lands in a public repository or a downloadable package, automated bots hunt exactly for these files. Even on a web server, a misconfiguration can make /.env downloadable from outside — security scanners check exactly this (how a scanner looks for it).

The correct setup

Put .env in .gitignore so it never enters the repository.
Create a .env.example with only the variable names (no real values) so everyone who picks up the project knows what to configure.
On hosting, use the environment-variable panel (like Vercel's or Render's Environment Variables) instead of uploading the file.
Before building any downloadable package (zip, installer), verify .env isn't inside.
Keep different values for development and production.

If .env leaked

Removing the file from the repository is not enough — it stays in Git history and may already be copied. You must:

Rotate every key it contained immediately: API keys, database password, token secret.
Check the service dashboards for signs of misuse.
Clean the history if needed — but assume the old keys are compromised regardless.

Developer note

For required variables, the app should fail fast with a clear error when a value is missing — not continue with defaults. This turns a silent misconfiguration into a visible one.