"Where .env Went Wrong" argues env vars became architecture they were never designed for.

Domen Kožar catalogs the failure: untyped strings with no way to encode required/secret/production-only, the proliferation of .env.local/.env.production as an implicit environment model contradicting Twelve-Factor, incompatible parsers across Node/Python/Docker for expansion and precedence, and a flat blast radius where every process inherits every secret. SecretSpec v0.17.1 separates committed declaration from secret storage with per-service scopes and local access audit logging. The scoping argument got a lot more urgent once coding agents started running in your shell with the full environment inherited.