Where .env Went Wrong: Why a Shortcut Became a Broken Architecture
The .env file started as a simple shortcut but evolved into a fragile architecture for managing secrets and configuration. It fails to define requirements, lacks a formal specification, and creates security risks by mixing sensitive data with ordinary settings. I argue for separating durable declarations from protected storage and explicit delivery to fix these fundamental flaws.
Environment variables do one job well: deliver strings to a process. .env turned that delivery mechanism into a source of truth. A convenience became architecture. That is where .env went wrong.