env-setup

name	env-setup
description	Environment configuration and secrets management. Use when setting up .env files, managing secrets, or configuring environments.
version	1.0.0
format	"2025-10-02T00:00:00.000Z"
triggers	["setting up"]
updated	"2026-04-25T00:00:00.000Z"
status	ACTIVE

Environment Configuration

Non-Negotiable Rules

Rule	Why
NEVER commit .env to git	Secrets persist in history forever
NEVER log secret values	Logs stored in plain text, forwarded
NEVER hardcode secrets	Source code is widely shared
ALWAYS use .env.example	Documents vars without exposing values
ALWAYS add .env* to .gitignore FIRST	Prevents accidental commit
ALWAYS validate config at startup	Fail fast, not hours into production

.gitignore (add before creating .env)

.env
.env.*
!.env.example
*.pem
*.key
credentials.json

Naming Conventions

• UPPER_SNAKE_CASE: DATABASE_URL, JWT_SECRET
• Prefix by service: DB_, REDIS_, AWS_
• Booleans: ENABLE_CACHE=true (not 1/yes)
• Feature flags: FEATURE_*

Key Patterns

• No defaults for secrets — force explicit configuration
• Validate at startup with Zod/Joi/Pydantic, not at first use
• Unique secrets per environment — one leak shouldn't compromise all
• Rotate leaked secrets immediately — check git history, audit access logs
• Process env always wins — CI/CD overrides file-based config