.secrets May 2026

For years, the industry standard was a file named .env . But as microservices exploded and supply chain attacks became the new normal, a new, more controversial player emerged:

In the world of software development, we are taught to value transparency, clarity, and collaboration. But every engineer knows that to ship a functional product, you must also master the art of hiding things. We hide API keys, database passwords, SSH private keys, and OAuth tokens.

find . -name ".secrets" -type f 2>/dev/null Then, to check Git history:

If you see a .secrets file, do not run the code. Run git rm --cached .secrets , rotate every credential inside it, and install a secret manager.

You cannot delete the concept of secrets from development—you can only choose where to store them. If you store them in a plaintext file named .secrets in your repository, you are not storing them; you are publishing them to everyone who clones your repo, scrapes your Docker image, or reads your CI logs.