one question about security

[vlucas]

one question about security

[vlucas]

Typically, your .env file will be below your web root, so it will never be web-accessible. If it is web accessible, you will have to take extra steps to ensure it is protected with .htaccess of nginx configs, etc.

[vlucas]

Also - In the ideal setup, your .env file itself will never be deployed with your project - the idea is that on the production servers, your environment variables will be already loaded and ready to go through some other config method. So really, dotenv itself and the file parsing step should really only ever be done during development.

[DanielFallon]

@vlucas could you go ahead and make this a bit more explicit?

It was obvious for me that this was true, but I just took over a project where a .env file was being used in production and was publicly exposed on the interwebz

Thanks, and looks like a great project!
DJF