After reading several articles about secrets, I understand that all secrets must not be deployed to a production repository. Thus, using a .env file is recommended by many posts. However, now I wonder where should I keep these .env files. Is there any best practice for where to keep them?
1 Answers
After reading this, that, this, and other articles, I concluded that there is no certain answer for this question; it depends on your organization / your preferences.
The recommended method for most applications is to save them at the root of your project, but include them in your .gitignore file in order to avoid them from being committed to your main repo (one .env file corresponds to each device/environment).
Other methods suggest including them in your repo, but encrypting and decrypting all the passwords inside of them once they load. Another method is to store them in password management programs like KeyPass, It really depends on how much effort you want to invest in the security and the time you would like to spend maintaining your application.
Related