Commit

Do you trust AI to not read you .env?

Since they are local and developing, meaning not important but never trusted for production. For developers, don't use production key/secrets in local development. That much easy.

Totally. Where do you keep your production keys/secrets then?

In the production server.