alt Hacker News> Where .env Went Wrong
start with making it a dot file. Why would you want to hide the fact your app was using loaded environment variables?
Replies
I hate that it's hidden too. There's no reason for it to be hidden and arguably some reason for it not to be hidden.
I did discover one reason for it not to be just "env" though, which surprised me, which is that "source env" will yield "bash: source: /usr/bin/env: cannot execute binary file". I did not expect the source command to use the $PATH to resolve the filename. Probably some minor security issues that can result from that out there in the world. Arguably anyone loading it should use "source ./.env" or equivalent, with full path.
It's documented in the bash manual, of course. But it is rather complicated as to when it will and will not use $PATH.
The fact that it's hidden means it doesn't get commited by accident in most git repos unless explicitly added or configured that way.