Using environment variables to store secrets instead of writing them directly into your code is one of the quickest and easiest ways to add a layer of protection to your projects.

GitGuardian Blog provides insights, tutorials, and updates on secrets management, code security, and developer best practices. Covering topics such as credential leaks, code scanning, and secure development workflows, GitGuardian Blog offers resources for developers, security professionals, and DevOps teams. Readers can learn about detecting and preventing secrets exposure, securing code repositories, and implementing secure coding practices through GitGuardian's articles and security guides.

GitGuardian

Using a .env file to store secrets provides a layer of protection in projects by keeping the secrets separate from the code and preventing them from being committed to version control.

Secure Your Secrets with .env

More often I’m hearing that is not secure to store your key apis and everything in a file in the server that could be hacked. Now the future are secret managers.

Ok but… there are other issues at play here which is having sensitive data lying around, unencrypted, and vulnerable to directory traversal and other concerns.
Simply moving files around or renaming them, doesn’t add security.
I wrote a bit on this topic here: <a href="https://lirantal.com/blog/environment-variables-configuration-anti-patterns-node-js-applications" target="_blank" rel="noopener nofollow">https://lirantal.com/blog/environment-variables-configuration-anti-patterns-node-js-applications</a>

Agree, That’s the best way to store application secrets and prevent from direct access of the resources 👨‍💻👍