985: Stop putting secrets in .env

Welcome to Syntax. If you have a dot EMV file sitting on your computer, this is the episode for you because we're gonna talk to you about why you shouldn't be doing that. My name is Wes Boss. And with us today, we've got Theo Ephraim and Phil Miller. They work on Varlock, which is a solution, a library that'll help you inject your secrets into your app and into your coding agents. But, we also just wanna, like, talk about just, like, why is everyone just putting, like, text files on their computer with all of their secrets when we have all of this? Like, logging into Notion for me is like a ritual where I have to, like, use a thousand things, and there's there's beep, bop, boom, pin codes and everything. And then then we just put the, like, database string in a dot e m v file. So welcome, guys. Thanks a lot for coming on. Yeah. Thanks for having us. So let's start there. Yep. What's wrong with dot EMV files? Yeah. I mean, why don't we first just talk about, like, you know, you have these files sitting there. Often, you're putting plain text secrets in there. And, you know, maybe you don't have any, like, super sensitive production secrets in there, but you still probably have some or, you know, maybe you needed to run some script that connected to production. So you put it in there once and, you know, you forget that the file's even there. And, you know, especially now in the era of AI coding agents where they're just reading all your files, slurping it all up, sending it off to some server, like, the only real safe way to ensure that they're gonna be not sent up to, you know, OpenAI is to get them out of plain text altogether. To go back a bit to to answer your question, I think the reason they're sitting in plain text is because every tutorial on the Internet, the first step is put the secret in plain text in a dot e n d file and then then do the rest of the tutorial. So everyone is still telling people to do that even though we know that it's wrong, and then we copy and paste those files on Slack. Right? I think that even the harder challenge is is for the most part that most people don't even know of a different way to do it. Like, that's just the way. Right? Yeah. Or the way that the way the easier way or sorry. The right way is, like, such a pain. Right? Or has seat fees of, you know, $20 per developer per month. So it's like, you're like, oh, I could do it that way, but it's just not worth the hassle. And people like to say that they do, you know, security best practice even if they don't always do them. Right? They're gonna they're gonna …