Welcome to Syntax. If you have a.env file sitting on your computer, this is the episode for you

because we're going to talk to you about why you shouldn't be doing that. My name is Wes Boss. And with us today,

we've got Theo Ephraim and Phil Miller. They work on Varlock, which is a solution, a library that

will help you inject your secrets into your app and

into your coding agents. But we also just want to talk about just like, why is everyone just

putting like text files on their computer with all of their secrets when we have all of this

like logging into Notion for me is like a ritual or I have to

like use a thousand things and there's beep-pop, bump, pin codes and everything. And then we just

put the like database string in a dot env file. So welcome guys. Thanks a lot for coming on. Yeah,

thanks for having us. Thanks for having us. So let's start there.

Yeah. What's wrong with that EMV files? Yeah, I mean, why don't we first just talk about like,

you know, you have these files sitting there. Often you're putting plain tech secrets in there.

And, you know, maybe you don't have any like super sensitive production secrets in there,

but you still probably have

some or you know maybe you needed to run some script that connected to production so you put it in

there once and you know you forget that the file's even there and you know especially now in the

era of AI coding agents where they're just reading all your files slurping it all up sending it off

to some server like the only real safe way to ensure that they're going to be not sent up to, you know, Open AI is to get them out of plain text altogether.

To go back a bit to answer your question, I think the reason they're sitting in plain text is because every tutorial on the internet, the first step is put the secret in plain text in a doty-end file and then do the rest of the tutorial.

So everyone is still telling people to do that even though we know that it's wrong.

And then we copy and paste those files on Slack, right?

I think that even the harder challenge is for the most part that most people

...