· 6 min · Eanvi
Why .env files fail on teams
Shared dotenv files leak, drift, and silently break deploys. Here is what actually goes wrong — and how Eanvi replaces the copy-paste loop.
The file that everyone has and nobody owns
A .env file starts as a local convenience. Then someone pastes it into Slack. Then staging drifts from production. Then a new hire clones the repo and ships with yesterday’s Stripe key. The format is fine. The distribution model is not.
Git ignore rules only protect the committed tree. They do not protect screenshots, CI logs, or the USB stick with last quarter’s backup. Teams need a source of truth that is encrypted, versioned, and scoped to an environment.
Drift is a product bug
When DATABASE_URL changes in production and not in the runbook, the next rollback is a guess. Version history on each secret turns that guess into a diff. You can see who changed a key, when, and restore the previous value without reconstructing it from memory.
Eanvi stores secrets per environment — development, staging, production, preview — so a local override cannot silently overwrite production. The CLI pull/push cycle keeps the local file as a checkout, not the canonical store.
Replace the ritual
Create a project, add an environment, import the existing .env, then run eanvi pull on every machine. New teammates receive an invite instead of a zip file. Audit logs record reveals and writes. The .env file can stay on disk for the runtime; it no longer has to be the team’s memory.