Stop Putting API Keys in .env Files — Use Your OS Keychain Instead

Last year, a developer at a YC startup pushed a .env file to a public GitHub repo. It contained their Stripe live key, an OpenAI API key, and a production database URL. Automated scanners picked it up in under 30 seconds. By the time GitHub's secret scanning revoked the tokens it recognized, someone had already racked up $14,000 in OpenAI API charges. This is not rare. GitGuardian's 2024 State of Secrets Sprawl report found 12.8 million new secrets exposed in public GitHub repositories in a single year. A 28% increase from the year before. And those are just the public repos — private ones are worse, because nobody is scanning them. 12.8M secrets exposed in public repos (2024) 28% increase year over year Your .env file is a liability. Here is why, and what to do about it. The dotenv pattern was never a security mechanism The dotenv pattern came out of the Ruby community in 2012. It solved a real problem: developers were hardcoding database passwords and API keys directly into source fi