Stop Using .env Files for Secrets: Encrypt Them with sops and age Instead (Real Output, gitleaks Included)

Thu, 29 Oct 2026 00:00:00 +0000

TL;DR

A committed .env file never goes away. After git rm the password is still readable with git show <commit>:.env and git log -p. The only real fix is to rotate the secret.
gitleaks finds it in milliseconds. In my run it scanned 105 bytes in 24 ms and reported 2 leaks (a Stripe-style key and a generic password); it exits with code 1, so a CI job or pre-commit hook can block the commit.
sops plus age lets you commit secrets safely. The values become ENC[AES256_GCM,...], the key names stay readable, and the diff of a changed password touches only that line plus the MAC and timestamp lines.
Decrypt at deploy time, not on disk. sops exec-env prod.enc.env 'your-command' puts the values into the environment of one process and writes no plaintext file.
Not your case? If your secrets live in Kubernetes, read Kubernetes Secrets first; if they live in Terraform state, read why the tfstate file should not be stored in git.