Why .env files are a security disaster (and what...

It happened on a Tuesday. A new hire, trying to get their local environment working, accidentally committed our production API keys to a public GitHub repository. What followed was a blur of adrenaline and panic: we had to completely take down the repo, invalidate dozens of keys, and manually rotate our entire infrastructure one service at a time. It was a hectic, miserable afternoon. But when the dust settled, we realized something important: we couldn't blame the engineer. The real culprit was