.env Files, Secrets & Doppler

01What a .env file is

Start from zero — no assumed knowledge.

Your apps need secrets to work: a Stripe key to take payments, a Supabase key to read the database, an Anthropic key to call Claude. Those values must reach the code somehow.

The naive approach is to type them straight into the code:

// NEVER do this
const stripe = new Stripe('sk_live_51H8xK2eZvKYlo2C...')

That's dangerous, because code gets committed to git, shared, forked, and pasted into chat. The secret travels everywhere the code travels — and git remembers it forever, even after you delete the line.

So instead, secrets live in a separate file that is deliberately excluded from git. The code reads them at runtime:

STRIPE_SECRET_KEY=sk_live_51H8xK2...
ANTHROPIC_API_KEY=sk-ant-api03-xY9...

const stripe = new Stripe(
  process.env.STRIPE_SECRET_KEY
)

process.env is the bag of environment variables handed to your app when it starts. On your laptop, Next.js fills that bag from .env.local. On Vercel, it's filled from the dashboard's environment-variable settings. Same code, different values per environment — that's the whole point.

02The four file types

The naming is confusing and the difference matters enormously. This is the single most useful table in the guide.

What a correct .env.example looks like

STRIPE_SECRET_KEY=sk_test_...
ANTHROPIC_API_KEY=sk-ant-...
DATAFORSEO_LOGIN=your@email.com

STRIPE_SECRET_KEY=sk_live_51H8xK2eZ...
DATAFORSEO_LOGIN=eric@boommedia.us
DATAFORSEO_KEY=yZXJpY0Bib29t...

How .gitignore protects you

.gitignore is a list of files git should pretend don't exist. Every one of your repos has this rule:

# .gitignore line 35 — matches .env, .env.local, .env.anything
.env*

The * is a wildcard, so this catches every variant — including, as it turns out, .env.example. That's slightly over-broad (most projects add !.env.example to un-ignore the template) but in your case it accidentally saved you. More on that next.

03NEXT_PUBLIC_ — the prefix that ships secrets to the browser

The most misunderstood thing in Next.js, and a genuine way to leak a key while doing everything else right.

Next.js runs code in two places: on the server (private, your infrastructure) and in the browser (public, on the user's machine, fully inspectable). Environment variables are only available on the server — unless the name starts with NEXT_PUBLIC_.

Which of your variables are correctly public

04Your actual audit — all 17 repos

Checked 2026-07-20 against every repo's git index, not assumed.

What's tracked in git

Twelve repos track an .example template — Approvee, Assistee, Compliee, Dashee, Localey, Posttee, QRcodee, Replyee, Rewardee, Servvee, bm-vercel, boo-v2. All placeholders. All correct.

Repo visibility

The three things to fix

05Google Drive is your real exposure surface

The finding that changes where you should actually focus.

Everyone worries about GitHub. But your entire SaaS portfolio lives in G:\My Drive\... — a synced Google Drive folder. And .gitignore means nothing to Google Drive.

Every real secret across all 17 apps — every Stripe live key, every Supabase service-role key, every Anthropic key — is sitting in Google Drive right now, synced. That's not automatically wrong; it's a legitimate backup. But it means:

• Anyone with access to that Drive folder has every secret you own. Check the sharing settings on the parent folder — that's the actual access-control boundary, not GitHub's.
• A shared link to a parent folder shares the .env.local files inside it.
• Google Drive keeps version history, so deleting a secret doesn't immediately remove older copies.

06Doppler — the fix

You already provisioned it. This is how to finish wiring it in.

What it is

Doppler is a secrets manager: one central, encrypted, access-controlled place where secrets live. Instead of every app having its own .env.local scattered across your disk, each app pulls its secrets from Doppler at run time.

Addee/.env.local      32 vars
Bloggy/.env.local     40 vars
Rankee/.env.local     ?
boo-v2/.env.local     ?
...×17, all on Drive,
all manually synced to Vercel

Doppler
 ├─ addee    → dev / prod
 ├─ bloggy   → dev / prod
 ├─ rankee   → dev / prod
 └─ boo-v2   → dev / prod
      ↓ auto-syncs to Vercel
      ↓ injected locally on run

Why it's worth the setup cost

Setup — start with one app, not all seventeen

# Windows (PowerShell)
winget install doppler.doppler

doppler login

cd Replyee
doppler setup          # create/select project + config (dev)
doppler secrets upload .env.local   # import everything at once

doppler run -- npm run dev

"scripts": {
  "dev": "doppler run -- next dev",
  "build": "doppler run -- next build"
}

# verify Doppler has everything first
doppler secrets

# then remove the file from Drive
rm .env.local

Doppler in Coolify

Coolify has no native Doppler integration, so use a service token — a read-only credential scoped to one project and config:

# create a token scoped to prod only
doppler configs tokens create coolify-rankee --config prd --plain

# on the server, run the app through Doppler
DOPPLER_TOKEN=dp.st.prd.xxxx doppler run -- npm start

Set DOPPLER_TOKEN as the single environment variable in Coolify. Everything else comes from Doppler.

07Rotation — how to change a leaked key

"Rotating" means replacing a key with a new one so the old value stops working. Order matters.

1. Create the new key in the vendor's dashboard. Most allow multiple active keys — that overlap is what makes zero-downtime rotation possible.
2. Update Doppler (or Vercel, if not yet migrated) with the new value.
3. Redeploy so running instances pick it up. Environment variables are read at boot — an existing process keeps the old value until restarted.
4. Verify the app works on the new key.
5. Revoke the old key. This is the step that actually closes the exposure. Skipping it means you did the work and gained nothing.

Your rotation list

The Displayee key is genuinely different from the rest. A key in a .env file is exposed to whoever can read that disk. A key in source code is exposed to every clone, every backup, every fork, and every future developer — and removing it later doesn't erase it from git history.

08Rules to work by

Quick self-audit — run this any time

# Is a real .env tracked in git anywhere?
git ls-files | grep -E '\.env'
# Only *.example lines should appear.

# Does .gitignore actually cover .env?
git check-ignore -v .env.local
# Should print the matching .gitignore rule.

# Any secret-shaped strings hardcoded in source?
grep -rnE '(sk-ant-api|sk_live_|[a-f0-9]{64})' src/

That last one is what surfaced the Displayee key. Worth running before any repo goes public.