A Config Diff Almost Shipped Debug Mode to Production. So I Built Something That Never Shows Me the Actual Secrets.

I was comparing two .env files before a deploy — nothing dramatic, just the usual "what changed since staging." Buried in a wall of unrelated lines was DEBUG=false quietly flipped to DEBUG=true. Easy