I write a lot of code, open source, and as part of large engineering teams. How poorly teams manage their development secrets, some that often overlap with production blows my mind. So I coded what I hope is a decent solution.

So, I don't know how prevalent or wide spread this problem is. But here it is: you join a new team and someone slacks you the .env file filled with 50+ API keys, client ids, secrets, it's a shell-like file, so some come with comments "please go sign up and replace this token with your own". But others don't. The entire team uses one key for a service X. And among the keys that folks share in development may just a few: three to five, are the same as the production keys. Noice. Oh wait, .env is git-ignored. Phew!

Cause nobody ever made a copy and accidentally committed it, as .env-alex and that fuzzy and warm git ignore rule only mentioned **/.env, so .env-alex went through and, well we squash merged the branches, so we are ok. Right? Gosh. God no.…