Stop Using API Keys in Environment Variables — Here's What to Do Instead

I recently audited a friend's startup codebase. They had 23 API keys in .env files. Three of those keys had been committed to git history. One was a production Stripe key. This is more common than you think. Let's talk about what to do instead. The Problem With .env Files .env files are convenient but dangerous: They get committed — even with .gitignore , someone eventually runs git add . They're shared insecurely — Slack messages, emails, shared drives They're not encrypted — plaintext on every developer's machine They don't rotate — most teams never change API keys until they leak A 2024 GitGuardian report found 12.8 million new secrets exposed in public GitHub repos. That's 35,000 per day. Level 1: Secret Scanning (Free, 5 Minutes) Before fixing your key management, find what's already leaked: # GitHub's built-in secret scanning (free for public repos) # Go to repo Settings → Code security → Secret scanning # Or use gitleaks locally: brew install gitleaks gitleaks detect --source .