Here is a common developer anti-pattern that every engineering team has committed:
A new developer joins the team. They need the environment variables to run the application locally. A senior developer opens their password manager, copies the plaintext .env block, and pastes it into a Slack message or a secure note. The new developer copies it, pastes it into a local .env file on their disk, and starts coding.
You have just created a massive security debt:
The credentials exist in plaintext inside your team chat history.
They exist on a local disk in plaintext, vulnerable to local script harvesting.
