Quick audit: where is your database password right now?
If you answered ".env file in the repo root" — you're in the majority. If you answered "also in a Slack message to the new hire, a screenshot in Confluence, and hardcoded in that one Lambda function that Dave wrote before he left" — you're being honest.
Environment variables are the most dangerous infrastructure in most startups because everyone treats them as an afterthought.
The Common Mistakes
Mistake 1: .env in Version Control
I've seen it in production repos at real companies. A \\
