it will read your env at some point. use SSM or server vars to manage the risk
Since they are local and developing, meaning not important but never trusted for production.
For developers, don't use production key/secrets in local development. That much easy.
No, I literally had to rotate keys because of this yesterday.
I think you can't fully trust them as long as broad
cat commands (or similar) are used. It's really easy to accidentally read the wrong files.
Haven't tried it yet but https://fnox.jdx.dev/ sounds promising with…
fnoxYour secrets, wherever they live | fnoxfnox loads secrets from encrypted files, password managers, and cloud secret stores into your commands, from one fnox.toml, on your laptop and in CI.