dotenv

It's pretty easy to find that the example I gave isn't gamed... A cursory search on GitHub can find a couple examples like dotenv [1] and npm's cli [2] both use it via an older version of nodejs/readable-stream [3]. There's also the classic left-pad debacle - https://github.com/left-pad/left-pad/issues/4 [1] - https://github.com/motdotla/dotenv/blob/master/package-lock.... [2] - https://github.com/npm/cli/blob/latest/package-lock.json [3] - https://github.com/nodejs/readable-stream/

Unfortunately, there is tooling, and a subculture that builds tooling, that uses configuration files in the same directory as the source code. Say you're deploying with cool-deploy-tool. cool-deploy-tool finds the password for the server by looking for a file called "Coolfile" in the project root. You have to create that file to use it. Now you have a footgun lying around. I associate this stuff with the Ruby community, but it's spread far and wide, notably to the Node and Go communities, which i think have large Ruby emigrant populations. As a prototypal example, consider dotenv, which began in Ruby: https://github.com/bkeepers/dotenv And has travelled to Node: https://github.com/motdotla/dotenv And Go: https://github.com/joho/godotenv

I use the `dotenv`[1] package with Node.js and it does exactly the same thing: environment variable definitions that you can store elsewhere in a dead-simple format. To be fair, I think they just copied the `foreman` tool from Heroku. However, it works great. Most projects don't need anything more than a flat hierarchy of secret keys and values. Writing your own parser for a `.env` file is a piece of cake, even in shell language. Adding `etcd` is better, but it's too much work for a small project. [1] https://github.com/motdotla/dotenv