Secrets Management: Why Teams Should Stop Using .env Files

X postJake HulbergTutorial

Jake Hulberg argues in an explainer video that development teams should neither share nor rely on .env files. Instead, he advocates for runtime injection using a centralized secrets manager like Infisical.

Key points

  1. Hulberg advises against sharing .env files, stating that runtime injection from a centralized secrets store eliminates secrets sprawl.
  2. Developers execute their local commands wrapped by a CLI (such as infisical run -- npm run dev) to inject variables directly into the process environment.
  3. Centralized secret managers streamline credential rotation and access control by maintaining values in a single location.
  4. Personal overrides in tools like Infisical allow individual developers to customize specific variables locally without maintaining .env files.
  5. To address AI agents exfiltrating credentials, Hulberg highlights an Agent Vault concept that supplies agents with dummy keys.

Why it matters

Sharing and storing secrets in plaintext .env files creates significant security liabilities regarding rotation, access revoking, and repository leaks. Delivering environment variables directly at runtime prevents secrets sprawl while ensuring teams work against consistent configurations.

Analysis

Hulberg's approach shifts configuration workflows away from static local files toward centralized secrets orchestration. While this improves governance and credential handling, it requires developers to adopt CLI wrappers in their daily development routines.

Original post

Jake Hulberg

@JakeHulberg · 14 September 2026

"How do you share .env files as a team?" I see this question all too often. The answer is "You don't". And you actually don't need a .env file at all! In this video I break down what environment variables are, what the environment really is, and how runtime injection with t.co/aaF5CH8dHS

189 likes11 replies433 bookmarks133.9k views

View on X
More posts in the thread (9)
  1. Docs for the infisical CLI, used in this explainer! t.co/OyZpThpFAX
  2. @wiesson 🤣
  3. @battlecitymmo Yep this happens. Runtime injection more solves for secrets sprawl and issues downstream of that (rotation, access control, etc.) - we have a solution for credential exfiltration that you're describing called Agent Vault. Under this paradigm, the agent is given a fake key, and we
  4. @VihaanJagiasi Docs above. npx skills add infisical/ai-skills for the above. Happy learning!
  5. @itsalwaysthedns Two things: 1. Italwaysdns is an awesome handle 🤣 2. With a secret manager, you can update the value in one place and every dev only has to run “Infisical run — npm run dev” instead of their run command. They don’t have to manage a .env file at all :) as shown in the video,
  6. @itsalwaysthedns Yesss in Infisical we have something called “personal overrides” that do just this! You can override values just for yourself. Super useful (and still no env file hehe)
  7. @itsalwaysthedns SG, let me know if there's anything we can do better! And happy to help out wherever needed
  8. @tiisetsomjlf Thank youuu!
  9. @JimmyBoonen Hahaha thanks so much! Glad you found it useful
Selected replies (5)
  • @itsalwaysthedns @JakeHulberg Yeah but then you get to manage secrets at your secrets manager and the .env because adding a line in .env in development is faster. And then none’s gonna care about the secret manager’s hassle anymore
  • @JimmyBoonen @JakeHulberg That was so insanely well explained, holy fuck. Even though I had a good understanding of it, the way you articulated it all and then supported it with video is top tier.
  • @battlecitymmo @JakeHulberg Am wondering if AI will just read the runtime injection at some point and leak the credentials.
  • @itsalwaysthedns @JakeHulberg For local development we could add an env file either way to add/override anything that the secrets manager added I can see how it helps
  • @itsalwaysthedns @JakeHulberg That’s really cool. I’ll give infisical another shot I self hosted it quite some time ago for my k8s cluster but then i moved to gitops secrets management cus it was simpler and kept everything in my argo repository

Mentioned links

Links and tools from this entry

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Link:infisical.com

    Infisical: Open-Source Security Infrastructure for Developers and AI Agents

    Infisical is an open-source platform (MIT licensed) covering secrets management, certificate lifecycle management (PKI), and privileged access management (PAM). Designed for modern cloud environments and AI agents, it prevents credentials from being committed to disk or leaked via LLM prompt injection by brokering API calls and access sessions.

    AI & LLMs· Tool

  • X post:Elia

    Field Report: Why Cloudflare Stands Out as an All-in-One Platform

    Developer Elia shares his hands-on experience using Cloudflare across side projects and enterprise work. Moving away from on-prem infrastructure and Vercel, he highlights the benefits of Cloudflare Workers, R2, D1, and integrated security tooling.

    148bookmarks31.2kviews

    Web development· Opinion

  • X post:Mia

    NVIDIA Sync: Local Network Access and Setup for DGX Spark

    An NVIDIA guide demonstrates how the NVIDIA Sync desktop application streamlines connecting laptops to DGX Spark devices over a local network, replacing manual terminal commands.

    160bookmarks9kviews

    AI & LLMs· Tutorial

  • Video

    Video:Greg Isenberg

    Managing Teams of AI Agents: Ryan Carson on Cloud-First Development

    In an interview with Greg Isenberg, Untangle founder and former Treehouse CEO Ryan Carson outlines how knowledge workers are evolving into managers of AI agents. He shares why cloud-hosted VMs replace local environments, how he ships 22 to 40 PRs daily, and the operational automations required to monitor agent behaviour and secure production keys.

    AI & LLMs· Talk

  • X post:AYi

    8 Rules for AGENTS.md: Cutting Token Waste and AI Over-Engineering

    Drawing from experience across approximately 60 billion processed tokens, Marcos Hernanz from Vercel's Next.js team compiled eight fundamental rules for AGENTS.md. The configuration steers coding agents toward writing pragmatic, minimal code instead of introducing superfluous abstractions and unnecessary dependencies.

    5kbookmarks403.3kviews

    AI & LLMs· Resource

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.