Every project starts the same way. You need an API key, so you drop it in a .env file, add .env to .gitignore, and move on. Totally fine for day one. The problem is that day one becomes month eighteen, the .env approach quietly becomes your entire secrets strategy, and now you've got credentials scattered across developer laptops, CI configs, and server environment variables with no idea who has what or when anything last changed. Nobody decided to run secrets this way. It just accumulated. Let me walk through what actually goes wrong and what to do instead.
The .env file's real problems
The .env file isn't evil, it's just not a strategy, and here's where it breaks down as you grow. It lives on disk in plaintext, so anyone with access to that machine can read every secret. It gets copied around, to laptops, to servers, pasted into Slack when someone's setting up, and every copy is another place a secret can leak. There's no access control, it's all-or-nothing, if you can read the file you have everything. There's no audit trail, no way to know who accessed a secret or when. And there's no rotation story, changing a secret means hunting down every copy and updating it by hand, which means in practice nobody rotates anything, ever.
