Environment Variables
Environment Variables
What are environment variables?
- Configuration values kept outside the code
- Keep API keys and passwords safe
- Swap values per environment
Once you start using environment variables, the nature of your code changes. Code with the keys removed becomes an asset you can safely show to others, and you can upload the same code as is to development, staging, and production servers, with each server reading the values for its own environment. Since no one has to open a file and hand-edit server addresses or passwords at every deployment, incidents where test settings ride along to the production server also become less frequent.
The values you put in environment variables fall into two kinds. One is secrets, such as API keys, database passwords, and tokens, where a leak puts money and customer data at risk. The other is per-environment settings such as server addresses, log levels, and feature on/off switches. Secrets need a higher level of protection. A .env file is enough when you work alone, but once a team joins, you typically move to GitHub Actions Secrets or your deployment platform’s environment variable settings. If you handle customer data, you move on to a dedicated vault such as AWS Secrets Manager and a rule of rotating keys once a quarter.
There is one boundary to watch. A .env file is not encryption. It is just a text file listing names and values, so anyone with access to that server or laptop can open it. In practice, that means separating the files and giving equal weight to who can get into that server. It also means setting a monthly usage cap and call alerts on every key, so that even if one leaks, the damage stops within the cap.
The most common mistake in the field is the belief that “I created a .env file, so we’re safe now.” Even if you add gitignore later, a key that was ever pushed stays in the commit history, and making the repository private doesn’t help: anyone who digs through the old records will find it. Teams also often miss that frontend variables used in the browser (such as NEXT_PUBLIC_ ones) are environment variables in name only and are fully visible to users, and that the moment you paste an entire error log into an AI chat window, any key in it goes along. A leaked key can’t be erased; the only fix is to revoke it and issue a new one.
Jaryong KooMarketing PhD and authority in AI, data analytics, and personal branding
John KimAuthor of B2B Marketing Design and CEO of Nanum ConsultingAn old way for operating systems to pass settings to programs, now established as a practical principle of keeping code separate from configuration and secrets.
Consider a hypothetical case. At Company A, a cosmetics distributor with 140 employees, a marketing team with no developers built a product-inquiry chatbot in two weeks by asking AI for help. They uploaded the code to a public GitHub repository so teammates could try it out. Ten days later, the AI API bill, normally KRW 180,000 (≈ US$135) a month, came in at KRW 4.7 million (≈ US$3,520).
- Assistant Manager Park of the marketing team saw the billing alert and reported, 'Fewer than 300 people have even tried our chatbot.' The IT team then found more than 40,000 calls from overseas IP addresses in the logs.
- Mr. Kim, the IT operations manager, revoked the old key and issued a new one within 30 minutes. But scrubbing the key that remained in the commit history was another matter, and they ended up creating the repository from scratch.
- Afterward, the team moved the keys into a .env file and added it to gitignore. They also left a .env.example listing only the variable names in the repository, so a new teammate can finish setup in 15 minutes.
- Senior Manager Kim split the keys into separate development and production keys, set a monthly limit of KRW 300,000 (≈ US$225) per account, and added usage alerts, so that calls stop automatically once the limit is exceeded.
- After a 40-minute in-house training session for 26 non-developer employees, there were zero key leaks over the next six months, and the API bill dropped from KRW 4.7 million (≈ US$3,520) to KRW 210,000 (≈ US$155) a month.