Goal
Keep secrets out of the repo and document required configuration safely.
Do
- Store secrets in
.envonly; never commit real keys. - Update
.env.examplewith new variable names and defaults. - Prefer server-only env usage for secrets (API routes, server components).
- Sanitize logs to avoid leaking tokens.
Don't
- Commit secrets or embed keys in client code.
Examples
- "Add a new API key and update
.env.example." - "Move client-only env usage to a server route."