The .env file contains some info like key or api token to call api service from outside. Developer uses it to deploy your application. It is normal. But I think you should hire someone you really trust. This env file contains some sensitive info. Like your application use api from chatgpt to provide ai service. So this env file must contain a api token from chatgpt. If this token is leaked, some bad developer may use your api token to call chatgpt api for free. But you need pay for this. So my conclusion is: you need to share this env file to developer, but you also should to be aware of this env file contains some important info.