Comment by Ather Sajjad on "Dotenv-vault: The New Way to Manage .env"

CommentDotenv-vault: The New Way to Manage .env

Ather Sajjad

Software Developer @Startup

May 25, 2023

This looks nice, will try it out for personal projects 😄, but from the article it seems it still pulls the config value which will reside in the .env file. Look at how Doppler handles it, it doesn't put the value in files. you can see the secret using command but it's mostly abstracted, and it has better integrations with all PaaS providers like vercel, heroku

Hoh Shen Yien

I write codes and blogs 🍵

May 25, 2023

Ahhh, I haven't actually heard of Doppler before, will look into it, thanks for the recommendation! 😆

Doppler is doing great work. Good to have more solutions solving this problem. BUT Doppler does write to your local machine as well. It writes to a central location on your machine - usually inside a hidden folder in your user root.

We thought about this long and hard but opted to stay 'decentralized' with project-centric .env files. Makes it more difficult if an attacker gained access to your machine. They would have to do much more work to access your secrets - iterate through all your projects on your machine. With doppler, the attacker can access a single location to find all your secrets.

Search Hashnode