[xinbenlv]

We use infiscial and other mechanism but hey, wouldn't it be nice to have one less square inch of attack surface?

[globular-toast]

Why not have one less square mile of attack surface by not having secrets in a .env file in the first place?

What are people doing that requires something like this?

[pjjpo]

I think it's common to have dev not production secrets there, and am reading the blurb about production secrets as non-local secrets. Even dev keys are a pain if they get leaked.

The idea seems nice with a simple yet effective implementation. While I think I currently have a shell script syntax highlight plugin reading env files, it's definitely overkill. Now if only this could protect from random npm packages reading your env files...