Classify each setting
Public configuration can include a display name or public endpoint. Sensitive settings include credentials and signing material. Treat them differently when choosing storage and permissions. Browser code is visible to visitors: a variable embedded in a frontend build is public regardless of its name.
Document names, not secrets
Maintain example configuration with explanations and harmless placeholders. Validate required values at startup and report a missing variable name without printing its contents. Keep development, preview and production settings distinct. Review configuration changes with the same care as code.
Rotate access deliberately
When replacing a credential, update dependent services and verify the result before revoking the old value where the provider supports that sequence. Revoke exposed credentials promptly. Do not copy whole environment files into tickets or logs; share names and redacted errors instead.
APP_ENV=production
PUBLIC_SITE_URL=https://example.com
API_BASE_URL=https://api.example.com