.env file

Not the same as configuration

Configuration describes how the app behaves and belongs in the repository. A `.env` holds the secrets that make it work — keys and passwords — and belongs nowhere near it.

Where it bites

The damage is done by the commit, not by the push. Once a key is in the history, deleting the file later does not remove it, and rotating the key is the only real fix.

Covered in these lessons

• Installing it, and what the install actually does
• What it can and cannot read

Related terms