Why dotenv files should not be checked in?

问题

I'm new to nodejs, so forgive me if my question is too trivial. I'm creating an enviornment files using dotenv.

However, on their WebSite, they recommend against checking in .env file. So, I was wondering if this files is not checked in , how will I tell the other developers about the environment variables that the application needs. They would require to fill out the values of environment variables because it could be used in all the places in the js (sever, config) files. And it would be non-trivial to look at every files that uses env variables and replace? Unless I'm missing something entirely.

Any help is much appreciated.

回答1:

Environment variables are typically used for environment-specific configuration values, like database credentials, API endpoints, and so on. Since they're environment-specific, and usually hold sensitive data like database credentials, .env files should not be committed.

If you want to show which environment variables are used, one method is to create and commit a sample file:

.env.sample

DB_HOST=localhost
DB_USERNAME=
DB_PASSWORD=
DB_DATABASE=our_project

Then it's up to the other developers to copy the same and create their own .env file (or just populate the relevant environment variables on their system).

来源：https://stackoverflow.com/questions/42014558/why-dotenv-files-should-not-be-checked-in