env-setup

Non-Negotiable Rules

| Rule | Why | |------|-----| | NEVER commit .env to git | Secrets persist in history forever | | NEVER log secret values | Logs stored in plain text, forwarded | | NEVER hardcode secrets | Source code is widely shared | | ALWAYS use .env.example | Documents vars without exposing values | | ALWAYS add .env* to .gitignore FIRST | Prevents accidental commit | | ALWAYS validate config at startup | Fail fast, not hours into production |

.gitignore (add before creating .env)

.env
.env.*
!.env.example
*.pem
*.key
credentials.json

Naming Conventions

• UPPER_SNAKE_CASE: DATABASE_URL, JWT_SECRET
• Prefix by service: DB_, REDIS_, AWS_
• Booleans: ENABLE_CACHE=true (not 1/yes)
• Feature flags: FEATURE_*

Key Patterns

• No defaults for secrets — force explicit configuration
• Validate at startup with Zod/Joi/Pydantic, not at first use
• Unique secrets per environment — one leak shouldn't compromise all
• Rotate leaked secrets immediately — check git history, audit access logs
• Process env always wins — CI/CD overrides file-based config