Use different secrets for development, staging and production

If your laptop's .env holds the production database password, every laptop is a production risk. A stolen or shared laptop, a debugging session on a coffee shop network, or a stray copy in a backup is now a production incident.

OWASP recommends separate secret stores for production and development. That split also lets you set access sensibly:

• Developers get broad access to test credentials, so they can work without asking.
• Very few people get access to production credentials.

In practice:

• Use test-mode keys from providers that offer them, for example Stripe sk_test_ keys.
• Run a local database for development instead of pointing at a shared one.
• Give staging its own keys too, so a staging leak does not reach production.

Check by reading your local .env: nothing in it should work against production.