{"id":2581,"date":"2026-05-30T03:31:46","date_gmt":"2026-05-30T03:31:46","guid":{"rendered":"https:\/\/tucumandevelopers.com\/index.php\/2026\/05\/30\/every-tutorial-tells-you-to-add-env-to-gitignore-thats-not-enough\/"},"modified":"2026-05-30T03:31:46","modified_gmt":"2026-05-30T03:31:46","slug":"every-tutorial-tells-you-to-add-env-to-gitignore-thats-not-enough","status":"publish","type":"post","link":"https:\/\/tucumandevelopers.com\/index.php\/2026\/05\/30\/every-tutorial-tells-you-to-add-env-to-gitignore-thats-not-enough\/","title":{"rendered":"Every tutorial tells you to add .env to .gitignore. That’s not enough."},"content":{"rendered":"
\n
\n
\n

Here’s something nobody talks about.<\/p>\n

.gitignore<\/code> doesn’t encrypt your secrets. It just hides them from git.<\/p>\n

They’re still sitting on your laptop as plaintext. Every tool you install can read them. Every script that runs can read them. One accidental commit and your database password is public on GitHub forever.<\/p>\n

So I built dotlock<\/strong> \u2014 an encrypted .env<\/code> vault with a terminal UI, written in Go.<\/p>\n

<\/a> <\/h2>\n

<\/a> Before and after <\/h2>\n

Before dotlock<\/strong> <\/p>\n

\n
DATABASE_URL<\/span>=<\/span>postgres:\/\/localhost\/myapp # plaintext, readable by anything<\/span> STRIPE_KEY<\/span>=<\/span>sk_live_abc123 # one grep away from anyone<\/span> <\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
After dotlock<\/strong> <\/p>\n
\n
# .dotlock file on disk \u2014 looks like this:<\/span> [<\/span>encrypted binary \u2014 unreadable without your private key] <\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
\n
  <\/a> How it works under 10 seconds <\/h2>\n
\n
cd <\/span>my-project dotlock set <\/span>DATABASE_URL # prompts for value, input is masked<\/span> dotloc # opens the terminal UI<\/span> <\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
Secrets are encrypted with age<\/a> \u2014 X25519 key agreement and ChaCha20-Poly1305 authenticated encryption. The same primitives serious security engineers use. No master password. No cloud. No telemetry. 100% offline.<\/p>\n
\n
  <\/a> What it looks like <\/h2>\n
<\/a>
 Two panels \u2014 profiles on the left, secrets on the right. Values are masked by default. Press v<\/code> to reveal for 30 seconds, then it hides itself automatically.<\/p>\n
Switch between dev<\/code>, staging<\/code>, and prod<\/code> profiles. Run a diff before deploying to catch missing variables before they break your app.<\/p>\n
\n
  <\/a> The interesting technical bit <\/h2>\n
The hardest part wasn’t the encryption \u2014 filippo.io\/age<\/a> makes that straightforward.<\/p>\n
It was the TUI.<\/p>\n
BubbleTea<\/a> uses the Elm architecture \u2014 Model, Update, View. Everything is a message. A keypress is a message. A timer firing is a message. Your Update<\/code> function receives messages and returns a new model.<\/p>\n
The 30-second auto-hide on secret reveal works like this \u2014 no time.Sleep<\/code>, no goroutines: <\/p>\n
\n
type<\/span> secretReveal<\/span> struct<\/span> {<\/span> key<\/span> string<\/span> value<\/span> []<\/span>byte<\/span> expire<\/span> time<\/span>.<\/span>Time<\/span> \/\/ Now() + 30 seconds<\/span> }<\/span> <\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
On every render, check if time.Now()<\/code> is past the expiry. If it is, zero the bytes and clear the display. Simple once you understand the model but it took me longer than I expected to get right.<\/p>\n
\n
  <\/a> Install it <\/h2>\n
\n
go install <\/span>github.com\/ahmadraza100\/dotlock@latest cd <\/span>your-project dotlock init dotlock ui <\/code><\/pre>\n
\n<\/p><\/div>\n<\/p><\/div>\n
Or download a binary from the releases page<\/a> \u2014 Mac, Linux, and Windows all supported.<\/p>\n
Full source, architecture docs, and security model on GitHub:<\/p>\n
\ud83d\udc49 github.com\/ahmadraza100\/dotlock<\/a><\/strong><\/p>\n
\n
What do you currently use for managing local secrets? Curious what others are doing \u2014 drop it in the comments.<\/p>\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>\n
Fuente: Art\u00edculo original<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Here’s something nobody talks about. .gitignore doesn’t encrypt your secrets. It just hides them from git. They’re still sitting on your laptop as plaintext. Every tool you install can read them. Every script that runs can read them. One accidental commit and your database password is public on GitHub forever. So I built dotlock \u2014 […]<\/p>\n","protected":false},"author":1,"featured_media":2580,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[41],"tags":[],"class_list":["post-2581","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devto"],"jetpack_publicize_connections":[],"_links":{"self":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts\/2581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/comments?post=2581"}],"version-history":[{"count":0,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/posts\/2581\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/media\/2580"}],"wp:attachment":[{"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/media?parent=2581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/categories?post=2581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tucumandevelopers.com\/index.php\/wp-json\/wp\/v2\/tags?post=2581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}