.env*

: Ensure the file is readable by the user running the application but not accessible to the public.

When that happens, .env-production is not just a config file anymore. It is a waiting to be stolen.

DB_HOST=localhost DB_USER=myuser DB_PASSWORD=mypassword API_KEY=your_api_key_here