'Where .env Went Wrong': SecretSpec Argues Env Vars Became Architecture They Were Never Designed For

SecretSpec / Hacker News·medium signalXBlueskyLinkedInCopy link

Domen Kožar's July 30 post (39 points, 21 comments) argues .env files deliver only untyped strings with no way to encode whether a value is required, secret or production-only, so an .env.example raises more questions than it answers. He catalogs the proliferation of .env.local / .env.production variants as an implicit environment model that contradicts Twelve-Factor, incompatible parsers across Node, Python and Docker for expansion and precedence, and the flat blast radius where every process inherits every secret. SecretSpec v0.17.1 separates the committed declaration from secret storage and adds per-service scopes, local access audit logging and provider-agnostic resolution — the scoping argument matters more once coding agents run in your shell with the full environment inherited.