Most local dev setups end up with some secret — an API key, a cloud credential, a database password — sitting in a plaintext file on disk indefinitely. Here's a simple pattern that avoids that, using AWS credentials as the example.
The problem with the usual approaches
A credentials file (e.g. ~/.aws/credentials) — plaintext, no expiry, no prompt. Anyone with filesystem access (malware, a compromised dependency, a careless backup, a stolen unencrypted disk) reads it instantly.
A .env file "just for now" — inevitably ends up committed once someone forgets it's there, or pasted into a chat while debugging.
Secrets exported in your shell profile — same problem, just moved into .bashrc or .zshrc, still plaintext, still readable by anything running as your user.
