We’ve all been there – that heart-stopping moment when you realize you’ve accidentally exposed sensitive information. Today, I’m sharing a personal story and introducing a tool that could save you from a similar nightmare. The Nightmare ScenarioLondon, February 2019, I was about to release an infrastructure project I’ve been working on for two weeks. I used the client’s AWS master key for testing. Yes, I know – I’m cringing too 😬. I pushed the container to a public repo for “easier access.” 🤡 Within seconds, an email arrived, cc’ing the entire company leadership about a critical security breach in production. Cold sweat. Near-firing experience. Lessons learned the hard way. The Common PitfallMany developers, especially those working on side projects or open-source repos, face a common dilemma: How do you store secrets locally in a way that’s both secure and convenient? Is it enough to put them in clear text and add them to . The answer is a resounding no. But the solution isn’t always clear. Enter: dotenvxHere’s where dotenvx comes in – a tool that could have saved me a world of pain. dotenvx is a “better .env” with three key features:
Getting Started with dotenvxInstallation is simple: `curl -sfS https://dotenvx.sh | sh # or brew install dotenvx` (I used Nix) Key Features:
Enhancing SecurityWhile dotenvx is a great start, it’s not a silver bullet. I recommend coupling it with security scanning tools like Snyk. These tools can help identify exposed secrets and other vulnerabilities in your project. Multi-Environment Supportdotenvx supports multiple environments (staging, production, etc.) through separate .env files. You can use the Docker IntegrationWhen using dotenvx with Docker, remember to:
The Balanced ApproachWhile .env files remain controversial in professional settings, tools like dotenvx offer a middle ground between security and practicality for side projects and open-source work. Remember, no solution is perfect. Always stay vigilant and use supporting systems to minimize risks. As always, feel free to reply directly with thoughts and comments. |
Every once in a while I send hand picked things I've learned. Kind of like your filter to the tech internet. No spam, I promise!
Hi friends, Are you tired of juggling multiple apps for note-taking and writing? Many of us struggle to find a seamless system that combines powerful text editing with effective note organization. While popular note-taking apps offer fancy features, they often fall short for those who prefer a keyboard-centric, or should I say Vim-centric workflow. Most people resort to using dedicated note-taking applications like Obsidian, Notion, or even Apple notes. These tools are great for casual users,...
Hi friends, The Dotfiles Dilemma Ever felt like your computer settings are scattered everywhere? Those pesky dotfiles that control how your programs look and work can be a real headache to manage. The Old Way: Git and Stow Many of us have tried using Git to track changes in our dotfiles. Some even use Stow to create symlinks. But let's be honest – it's not always smooth sailing. Sometimes things don't line up right, and not every program plays nice with this setup. Why Traditional Methods...
Hey friends! Are you tired of juggling countless environment variables across different projects? Do you find yourself constantly tweaking your .zshrc or .bashrc with tokens, api keys or other project-specific variables? Well, I’ve got a game-changer for you! The Problem with Traditional .env Files We’ve all been there. You start a new project, set up a few environment variables in a .env file, and everything’s peachy. But as your project grows, so does your list of variables. Before you know...