2 months ago
- .env files started as a convenient shortcut for setting environment variables but evolved into a flawed architecture for configuration and secrets management.
- They lack a schema, cannot express whether a value is required, secret, or environment-specific, leading to late failures and drift.
- The proliferation of .env files (e.g., .env.production) recreates brittle named environments, contradicting Twelve-Factor App principles.
- There is no formal specification; different parsers handle variable expansion, quotes, and precedence inconsistently, causing subtle bugs.
- Security issues arise because .env files are often committed, copied, or leaked, and they offer no encryption, access control, or auditing.
- The article proposes SecretSpec as a solution: a committed declaration file separates requirements, protected storage, and explicit delivery, reducing reliance on environment variables for secrets.