.gitignore entry: .env .env.*.local

.env.production # Dot - still slightly risky .env_local # Underscore - safer

Every day, a new .env-YYYY-MM-DD file was created. The .gitignore only listed .env (no asterisk). One day, a developer ran git add --all and committed 90 days worth of .env- files to a public repository. Within six hours, bots had scraped the AWS keys and spun up $50,000 worth of cryptocurrency miners.

When you use a library like dotenv (in Node.js) or python-dotenv , a magical thing happens.

It was a goldmine. And a tombstone. Lena scrolled further, but the file ended. No, wait. There was a second set of lines, commented out with # and a later timestamp:

Developers are lazy (in the best way—we hate repetitive work). The .env- pattern usually emerges from a well-intentioned desire to organize multiple environments without typing long commands.

The common thread? The hyphen.