I Audited My Team's .env Practices. Here's What I Found.

Last month I did something uncomfortable: I spent a Friday afternoon auditing how my team actually handles secrets. Not how we say we handle them. How we actually do it. I checked Slack history, git logs, CI configs, and local machines. What I found wasn't a disaster — it was worse. It was normal . The kind of normal that every team thinks is fine until it isn't. Here's exactly what I found, and what we did about it. The audit Team size : 5 developers, 3 services, 2 environments (staging + production). I looked at five things: 1. Where do .env files live? I asked everyone to run find ~ -name ".env" -not -path "*/node_modules/*" on their machines. Combined results: 23 .env files across 5 laptops 7 of them contained production credentials 2 developers had .env files for projects they left months ago 1 file had a Stripe live key and a database URL on the same line — copy-paste artifact from Slack The problem isn't that .env files exist. It's that they accumulate. Nobody cleans them up. No