Practices
Keeping .env.example in sync with every environment
A .env.example drifts because nothing breaks when it's wrong. Compare names, never values, fail CI on missing variables, and compare real environments.
Sharing .env files guide
Field notes on team secrets
Sourced write-ups on .env files, CI tokens, offboarding, contractors and audit logs, and on what a server that stores only ciphertext can and cannot see.
All posts
Secrets
Leaked Django SECRET_KEY: what it exposes and how to rotate
What someone can sign with your Django SECRET_KEY, why the fallback list works against you after a leak, and a rotation order that closes the gap.
Sharing .env files guide
CI/CD
Masked CI variables still leak: where masking stops
CI masking replaces exact strings in the job log, nothing more. Encoded values, JSON blobs, artifacts and untrusted pull requests all get past it.
CI and OIDC guide
Example. Kiteline is a fictional company.
More posts
Migration
7 min readMoving team secrets out of Ansible Vault
Why teams move secrets out of Ansible Vault, how to export them with ansible-vault, bring them into per-environment storage, and keep playbooks working.
Offboarding guide
Migration
7 min readMigrating from EnvKey: moving your environments
EnvKey Cloud closed on February 1, 2025, and the open source code hasn't changed since. How to export what's left, flatten it, and keep the encryption model.
Who can decrypt guide
Secrets
7 min readNEXT_PUBLIC_ leaks: how secrets get into a JavaScript bundle
Any variable with a public prefix is shipped to every visitor. How NEXT_PUBLIC_, VITE_, PUBLIC_ and NUXT_PUBLIC_ work, how to check your bundle, and what to do.
Sharing .env files guide
AI agents
7 min readPrompt injection meets your environment variables
A coding agent with a shell can print its environment, and text it reads can ask it to. How to make the keys within its reach worth little.
AI coding agents guide
Teams
8 min readRemoving someone from git-crypt, SOPS or Ansible Vault
None of the three can take back access someone already had. What each tool does when a person leaves, in what order, and why old commits stay readable.
Offboarding guide
Practices
7 min readRotating API keys without downtime: the overlap window
Issue the new key, roll it out, confirm the old one is idle, then revoke it. How AWS, Stripe and databases support overlap, and what to do when they don't.
Offboarding guide
Secrets
7 min readRotating Laravel's APP_KEY without logging everyone out
APP_PREVIOUS_KEYS lets Laravel 11 and later decrypt with old keys while encrypting with the new one. The order of steps, config:cache, and stored data.
Sharing .env files guide
Self-hosting
8 min readVault Community for a 10-person team: what you actually run
Running HashiCorp Vault Community means quorum, unsealing after restarts, snapshots you schedule yourself and audit devices that can stop it. The full list.
Self-hosting guide
Servers
7 min readSecrets in Docker images: build args, layers and checks
ARG and ENV values stay in a Docker image, and deleting a file in a later layer doesn't remove it. How to build with secret mounts and check an image.
Sharing .env files guide