```html

Env Variables: The Complete Developer Playbook — Setup, Security & Best Practices

Environment variables are the backbone of modern application configuration. Whether you're deploying a Node.js microservice, a Python data pipeline, or a React frontend, .env files are how you keep secrets out of your codebase and configurations out of your version control. This playbook covers everything you need to know — from basic setup to enterprise-grade secret management.

What Is an .env File?

An .env (environment) file is a plain-text configuration file that stores key-value pairs consumed by an application at runtime. It follows a simple KEY=VALUE format and is typically placed in the project root directory.

Why Env Variables Matter

Hardcoding configuration values — database passwords, API keys, feature flags — into source code creates three critical problems:

• Security risk: Secrets leak through version control history.
• Environmental drift: The same code behaves differently across dev, staging, and production.
• Operational rigidity: Changing a config value requires a code deploy, not a config update.

Environment variables solve all three by decoupling configuration from code.

Setting Up .env Files — Step by Step

Step 1: Install a Parser Library

Node.js does not natively read .env files. Install a parsing library:

• Node.js: npm install dotenv
• Python: pip install python-dotenv
• Go: go get github.com/joho/godotenv
• Rust: Use the dotenvy crate
• PHP (Laravel): Built in — no installation needed

Step 2: Create the .env File

Create .env in your project root with this structure:

NODE_ENV=development
DATABASE_URL=postgresql://user:pass@localhost:5432/mydb
API_KEY=sk-test-abc123
REDIS_URL=redis://localhost:6379
JWT_SECRET=my-super-secret-jwt-key
LOG_LEVEL=debug

Step 3: Load It in Your Application

Node.js example:

// MUST be the first import
require('dotenv').config();

// Now process.env is populated
const dbUrl = process.env.DATABASE_URL;

Python example:

from dotenv import load_dotenv
load_dotenv()  # Must be called before accessing os.environ

import os
db_url = os.environ['DATABASE_URL']

Step 4: Add .env to .gitignore

• Open (or create) .gitignore in your project root.
• Add the line: .env
• Commit the updated .gitignore.
• Verify: run git status — .env should not appear.

Environment Variables vs. Hardcoded Config — Comparison

Criteria	Hardcoded in Code	.env Variables
Security	❌ Leaks via git history	✅ Kept out of repo
Per-environment config	❌ Same value everywhere	✅ Different per env
Runtime changes	❌ Requires redeploy	✅ Change without deploy
Team onboarding	❌ No guidance on required values	✅ .env.example acts as docs
Auditability	❌ No change log	✅ Tracked in secret managers
Compliance (SOC2, HIPAA)	❌ Fails audit	✅ Meets requirements
Complexity	❌ Simple but dangerous	✅ Slightly more setup

Security Checklist — Protecting Your Environment Variables

Pre-Deployment Checklist

• .env is listed in .gitignore
• No secrets exist in git history (use git filter-repo if they do)
• .env.example exists with all keys but no values
• API keys use scoped/limited permissions (not admin)
• Database passwords meet complexity requirements
• JWT secrets are at least 256 bits
• Third-party service tokens are rotated quarterly
• CI/CD pipeline injects secrets from a vault (not from .env)
• No logging of env var values (add .env to log filters)
• Access to production env vars is restricted to authorized personnel

Production Deployment Checklist

• Secrets injected via platform secrets manager (not file-based)
• Container images do not bake in environment variables
• Environment-specific configs are enforced (no production DB on staging)
• TLS is enforced for all connections using env-provided certificates
• Audit logs capture secret access events