[.env] How to hide from others & share with teammates

[guillermovahi]

Good morning,
I think my question is very basic but I have not seeing a good response over the internet or a pragmatic solution.
First of all, I know how to hide my passwords using the common procedure with the dotenv package of node. Using this method I can provide security for myself, because I always have my "secrets" and private keys in my local machine, and they are never uploaded to the remote repository.
If I decide to form a team and we all want to use the same secret credentials for software development, this method would not allow me to share these keys easily, since they would be located locally on the computer of one of the members.
My question is: is there any method to hide the keys and at the same time the team can use them because they have access to the code?

[alymurtazamemon]

@PatrickAlphaC your experience on it would be helpful for all of us.

[alymurtazamemon]

@guillermovahi And by the way, very excellent question 👏👏👏. I have my own experience on it, but let's see what @PatrickAlphaC will share with us.

[guillermovahi]

Thanks mate, hoping @PatrickAlphaC can share any interesting advice for these kind of situation 🙃

[krakxn]

@guillermovahi

Any sort of .env usage is a single point of failure. The ideal approach would be a cryptographic one.

For minor projects, such misuse is hardly a nuisance even if teammates are malicious (unlikely). In this case, you can just create a private repo (w/ the .env pushed) and giving your teammates the access (for visibility).

[guillermovahi]

Hi, I am actually doing this methodology but I am not quite comfortable with it. Can you share any documentation related to cryptographic encoded method with other teammates?
Thanks!

[krakxn]

Refer: https://github.com/mozilla/sops

Good read (primarily for fundamentals): https://stackoverflow.com/questions/60360298/is-it-secure-way-to-store-private-values-in-env-file

What I personally would recommend is, just encrypt the values in the .env with some arbitrary nonce which is hard to "guess". Then, push the .env to GitHub (for contributions as well as collaboration). Only let your teammates know what the nonce was, so that they could decrypt the values in the .env; whilst this is sufficient, an ideal--corporate level--approach would be automated and complex involving ZK-proofs, and will unnecessarily be a waste of time for minor projects (unless you are working on something which cannot be risked to be exploited).

[guillermovahi]

Thanks for all the information provided, I will carefully read about it. I hope that an effective and practical solution will be developed sooner rather than later.