Search code examples
securityenvironment-variablesproduction-environment

Does using `.env` in production have security issues?

Does using .env in production have security issues? In other word, is it a bad practice to use .env files in production?

I remember reading something about this being an issue, but as of today it seems it's not considered as an issue anymore.

Is there caveats in using a .env file in production server?

Solution

  • IMO, there is no reason to consider the use of .env a security issue at all. In fact, the use of .env is precisely what many tools (e.g. spinnaker) use to have reproducible environments with specific configuration.

    I do use env files to iterate my service from develop to production, having a .env file for each stage.