Blog
Environment variables, secret handling, and the mistakes that leak them.
-
Envelope encryption, and what "encrypted at rest" actually promises
A practical explanation of wrapping a data key under a master key, why it makes rotation cheap, and the specific attacks it does and does not stop.
-
Managing environment variables across development, staging and production
Why the .env-per-developer approach breaks down, what drift actually costs, and the properties worth insisting on when you replace it.
-
How to remove a .env file from Git history
Deleting the file and committing is not enough. Here is how to rewrite the history properly, and why rotating the secrets matters more than the rewrite.