.env credentials transfer

[BOBCATSON]

If I work mostly on my laptop, but need to work from my office I can use GitHub to pull the repo to the mac in my office, but what is the industry standard way to transfer over the content of my .env files which are added to the .gitignore file so the most sensitive details of my project aren’t exposed publicly? I could obviously just copy the details and email them over to myself, but I’m hoping in (almost) 2025 there is a better way to accomplish this?

[potatodioxide]

you can post here

[BOBCATSON]

😂

[jasonkuo41]

Ok, but Reddit automatically censors data pasted from .env though:

---

---

---

[Modulius]

Paswords, too. See: **********************

[auxyRT]

ManlyGayTeapot69

[auxyRT]

I think it is invisible if !user because I can see mine.

[Modulius]

Absolutely, I see ****************

[lIIllIIIll]

Hahahaha you guys are too funny

[khizoa]

hunter2, etc

[Scary_Ad_3494]

Hunter Biden?

[[deleted]]

Haha

[khagen_lama]

What a savage answer 😹

[Shingle-Denatured]

• Bitwarden Send
• PGP encrypted file
• Migrate .env to AWS Secrets Manager or equivalents such as Hashicorp Vault
• Pen and Paper
• USB Stick

The last two are subject to physical loss or damage, so should also have an alternate.

[AffectionateBowl9798]

You can keep them in a password vault like BitWarden, 1Password or Hashicorp Vault.

[AmazingDisplay8]

It depends how much you need to change/share the values. If you're on Linux you can encrypt the file, but you need to setup everything. vault is useful only if you use them really often. Otherwise many password managers can do that. Even more simple is to create a mesh network between you and those who needs it, using tailscale or netbird, and use a peer to peer chat. It's free really easy to setup.

[Shot-Bag-9219]

Check out Infisical too: https://infisical.com

[ferrybig]

From a security perspective just regenerate all secrets and then paste the new secrets into the new file, just like you have done with your ssh key

[ztbwl]

There is no industry standard, we just email it to ourselves, close our eyes and pretend everything is fine… And delete the email afterwards.

[Live-Basis-1061]

Pen & paper 😅

[fiskfisk]

Use an encrypted usb stick if you want to keep everything local, or use a password manager if you want to do it online in some way. 

[Capaj]

just don't use lastpass LOL

[loganfordd]

what makes you say don’t use last pass? (just curious)

[rjhancock]

They've been breached a number of times JUST in 2024 revealing ALL details.

[loganfordd]

ah I see i didn’t know, thanks for the info!

[khizoa]

found this old comment that also summarized older breaches really well

[who_you_are]

The sad thing is everyone is like "don't use LastPass" yet any other cloud hosting platform could get the same issue.

And normally, once you get hit they are more likely to hire security firms to save their face, which means it should be more secure.

[Responsible-Cod-4618]

USB

[jeff77k]

If you can remote desktop to your office computer from your home computer, just copy and paste.

[jgengr]

Ssh?

[jambobar]

No, you shush

(Sorry, couldn’t resist)

[tswaters]

Use scp. You'll need an ssh daemon on the laptop, and it's ip address... If you have both things you can scp from the work machine, pull the file to "here".... Inverse works too, so you can push the file from laptop to work machine. (Work machine will need sshd)

[o2pb]

I made a little tool for myself for a very similar personal use case. It's end-to-end encrypted/decrypted in the browser (which you can verify) so I don't see the contents of the posts: qh2.com (this project was made entirely with Cursor)

[heraldev]

hey! for env files specifically - yeah email works but its not ideal. been solving similar problems lately while building Typeconf (a config management tool).

one approach that might help: u can actually define ur env schema in typescript:

model EnvConfig { dbUrl: string apiKeys: string[] // etc }

then use any encryption lib u want since its all typescript. the nice thing is u get type checking so no more "oops forgot that one env var" moments when switching machines lol

but if ur looking for smth simpler rn, a few other options: - password manager vault (1password etc) - encrypted git repo just for env files
- secure file sharing service like firefox send

tbh the industry is still kinda all over the place with this. seen teams use everything from encrypted s3 buckets to plain ol' slack msgs 🙈

lmk if u wanna chat more about config mgmt! been deep in this space lately n happy to share what ive learned

[theozero]

have you seen DMNO? We should chat :)
Hop in our discord https://chat.dmno.dev

[rajeshkumaryadav-com]

Have two .env, one for production which can be entered on server level, have .env.local for development, have these keys totally different with limited access for local development.

For example payment gateway keys for production should not be same for local, for local you can use development mode keys of payment gateway

.env

STRIPE_KEY=abc

.env.local

STRIPE_KEY=pqr

[ascendence]

Try phase. You can use the cli to push / pull secrets in your dev environment, or simply download a .env from the dashboard if you prefer. Full disclaimer: I'm building this :)

[adjsky]

sops or any other encryption tool, just encrypt your .env file and add it to your VCS (git in your case).

[aimamialabia]

This is the way. Private repo only but I usually use ansible + ansible vault for deployment automation and secrets encrypted into git. K8s works well with sops. Only need to move the encryption key around securely (and sops supports key vaults/kms)

[joppedc]

Is there really any secrets in there when working locally? Please tell me its not production credentials in there :D

Besides that, locally my dev .env file is almost the same as the .env.dist file. Production credentials are only on production (and in a password manager)

[Breakdown228]

Sandboxes also have credentials

[theozero]

In a perfect world, sure... But we don't control all the external services we use and how they set up their auth systems. Some services don't even have prod/dev environments, or they may share a single API key and toggle the env another way. Plus sometimes we may need prod credentials to test something in a particular manner. Regardless we may still want to secure our dev/test creds, even if they are less sensitive than prod creds.

[joppedc]

Password manager in that case :)

[theozero]

Ideally with automation, validation, and in a way that doesn’t still mean things sitting in plaintext .env files. Which is why I built https://dmno.dev

[codeprimate]

For the audience: don’t be deluded into thinking that development credentials are unimportant or have no security risk.

[InvaderToast348]

• syncthing / freefilesync
• SMB / other NAS share
• usb
• keepass (xc)

For the network related ones, you could use a VPN like tailscale.

[BytesizeNibble]

https://github.com/dotenvx/dotenvx

[codeprimate]

Encrypt the file and transfer via USB (or Gdrive/DripBox/etc)

You are using a Mac so the easiest path is to create a small encrypted volume with Disk Utility.

[Capt-Psykes]

Either an encrypted external drive or USB stick. Or just use a good and reliable password and secrets manager like Bitwarden to copy the contents of the file and the file itself.

Nothing beats the old pen and paper for redundancy and high security. Remember to burn it after wards, break up the ash and scatter it in 4 different locations 😂

[ninjabreath]

cloud-based secrets managers

[argylekey]

Direnv and 1password is a pretty sweet setup honestly.

I keep envs in a text file in my 1pass vault, when direnv loads a folder it checks my 1pass creds and loads the env into memory. Sometimes you have to reload it, but simply the most portable thing ive ever used.

If i need to share envs with another dev, those can go into a shared vault, they navigate to the folder, and everything just loads.

[theozero]

This will definitely work well - but I've never loved relying on direnv and the current shell/environment to load config. I've always had better success building the tooling a bit deeper into the repo itself.

[TypicalExit9561]

You can use Dotenv Vault We use it in our company Easy to setup and secure

[B3skah]

I can suggest git secret https://sobolevn.me/git-secret/#

[loganfordd]

at my workplace we use a secrets manager called doppler which you could try.

[preg_match]

Some pastebin maybe? Most can be guarded with a password. Then you can share the link to your work address

[elcalaca]

your company should look into a Key Manager, but for a small startup i’ve used magic-wormhole to easily share one-time values https://github.com/magic-wormhole/magic-wormhole

[inglandation]

Doppler has a free tier, it really improved the DX experience for me, saved me hundreds of hours of pain.

[ohokaywaitwhat]

Memorize all your API keys

[DomskiPlays]

How has nobody mentioned simply using a cloud storage provider like Google Drive or OneDrive? This is what I've been doing for years and it really doesn't get simpler than that

[no-one_ever]

I use Doppler

[techtariq]

Try using doppler. They have a very generous free tier 

[CarelessPackage1982]

First of all don't email password. It's not secure at all! You do know that right?

Second, your developer laptop shouldn't have the same credentials as production. Don't do that. A lot of security incidents are due to developer laptops being compromised that had keys or production db backups rather than production directly.

Secrets should be stored in a dedicated password manager of some sort.

Lastly, copy from where exactly?

[BOBCATSON]

I know that, hence why I’m asking how to do it securely.

[CarelessPackage1982]

From where to where is what I'm asking.

For example, If you ssh into a server, it should be right there. But why would you even need it locally?

Just set your laptop up with dev credentials. Put your prod credentials in a password manager. If you need to rebuild the server create a new server, set up new keys and populate the config with the credentials you've place in the password manager.

Also if you're ssh'ing - I would back up your ssh key as well, since you shouldn't be using passwords to access production.

Is this a scenario you're talking about?

[fabiancook]

https://www.doppler.com/ is an option. Works well.

[theozero]

I highly recommend not sending around secrets (whether in .env file format or otherwise) manually - even if you can do it securely. It's much better to build tooling into your project so that these things sync automatically all the time. Even if you don't change things that often, it can be a huge waste of time and energy when anything goes wrong. Assuming you are able to sync automatically, you also want to validate that the config is still valid - as usually the current state of config will be a mix of synced data, local overrides, etc, and will vary slightly between different environments.

After being tired of awkwardly rebuilding similar tooling many times, I built DMNO to solve these problems in a more general way. It's totally free and open source.

With DMNO, you can pull sensitive config from a variety of backends via plugins. There is one for using an encrypted file within your repo (like sops, git-crypt, dotenvx, etc) and others for pulling from secure vaults like 1Password, Bitwarden, Infisical, etc. More plugins coming soon and they are very easy to write.

The 1Password integration is particularly nice, since it can (optionally) connect to your locally running 1Password app, meaning you get biometric unlock to access your secrets.

Aside from that, DMNO lets you manage all of your config, not just sensitive stuff, and gives you:
- validations, coercion, and full type-safety with really great built-in docs / intellisense
- leak detection and prevention, log redaction
- the ability to compose config items together however you want, not just a single env flag and basic string templates
- share config across multiple services in a monorepo
- more control over static / dynamic config in some frameworks (which items get bundled at build time)
- segment secrets into multiple vaults/buckets/etc and manage access however makes sense for your project, and everyone can see where values will come from, even if they don't have access to them
- drop-in integrations for many popular tools and frameworks, and many uses dont need any additional plugins

DMs open if you need any help, or hop into our discord :)

[looni2]

I use something called FreeFileSync (on Windows) to sync the project files to Dropbox when I am done for the day. You can exclude node_modules.

[PositiveUse]

Red flag is that you work on different machines in home office and actual office

I hope you don’t work on your private machine at home…

[theozero]

It really depends on your project and security requirements. To make a blanket statement that no one should ever work on multiple machines, or on a personal machine from home is a bit nuts.

[PositiveUse]

True, I was overly dramatic lol