[tasuki]

> If it reads your .env just to see the variable names, the secrets have been sent to the servers.

But these are development secrets. They're of no use to anyone.

Production secrets probably live in another repo, or at least are stored encrypted. In my case both. And I'm managing the least sensitive stuff you can imagine: a pre-school website, a non-profit event website, personal blog...