Goal

Keep secrets out of the repo and document required configuration safely.

Do

• Store secrets in .env only; never commit real keys.
• Update .env.example with new variable names and defaults.
• Prefer server-only env usage for secrets (API routes, server components).
• Sanitize logs to avoid leaking tokens.

Don't

• Commit secrets or embed keys in client code.

Examples

• "Add a new API key and update .env.example."
• "Move client-only env usage to a server route."