Post: "Your app never reads your .env file (how dotenv actually works)"
r/node
Extracted from these lines
[comment u/ribugent] Personally in my job we're using direnv for setting environment for "complex" setups and fetching some secrets from the vault.
“No but your agent does. Prrrrr-tishhh.”
u/block-bit48 points · Sep 25, 2026View
“node --env-file=.env index.js Natively supported since Node 20. Not sure why folks are still using dotenv.”
u/paulirish32 points · Sep 26, 2026View
“This article is mostly just an ad for Infisical. That said, I'm glad it's here! The problem of dispersed plaintext secrets is a very real one that any team will run into and ought to be aware of. For a free, self-hosted solution to the same problem, check out Sigillo, https://github.com/remorses/sigillo”
u/thicket18 points · Sep 25, 2026View
“use varlock (free open source)! .env as most know it is full of footguns. Varlock helps gets all secrets out of plaintext, adds tons of amazing DX while still feeling familiar.”
u/theozero14 points · Sep 25, 2026View
“Idk… sharing production db credentials outside something that provides access - e.g metabase is a bad practice to begin with…”
u/Single_Advice11116 points · Sep 25, 2026View
What this signalsUser posts often show product pain before it reaches reviews or churn.
Topics
reddit-companycustomerFeedbackGet every Reddit signal for HashiCorp and the companies you sell to, in the tools you already use.
Connect Autobound to Claude, Claude Code or Cursor with MCP. Then ask: “What changed at HashiCorp this week?”
The Signal API returns Reddit signals for any list of companies as JSON, for your CRM, warehouse or app.
Sign up and spend your free credits on the companies you sell to.
This page shows a preview. The full reddit-company record in the Signal API and MCP can also have these 8 fields. Some fields are empty for some signals.
Company
linkedin_urlValue in the APIindustriesValue in the APIemployee_count_lowValue in the APIemployee_count_highValue in the APIrevenueValue in the APIdescriptionValue in the APISignal
signal_nameValue in the APIassociationValue in the APIGET /v1/signals/2a5f3709-c80b-5dd7-a320-068349fbd9e6 returns this record as JSON. POST /v1/companies/enrich returns every signal for hashicorp.com.
{
"signal_id": "2a5f3709-c80b-5dd7-a320-068349fbd9e6",
"signal_type": "reddit-company",
"signal_subtype": "customerFeedback",
"detected_at": "2026-09-25T15:21:59+00:00",
"company": {
"name": "HashiCorp",
"domain": "hashicorp.com"
},
"data": {
"nsfw": false,
"stage": "switched",
"awards": 0,
"timing": "ongoing_state",
"topics": [
"secrets management",
"security",
"developer tools"
],
"post_id": "1wpz65z",
"summary": "A commenter mentions their company uses HashiCorp Vault to fetch secrets as part of their development workflow.",
"category": "security",
"comments": [
{
"url": "https://www.reddit.com/r/node/comments/1wpz65z/comment/pbzolpw/",
"depth": 0,
"score": 48,
"author": "block-bit",
"excerpt": "No but your agent does. Prrrrr-tishhh.",
"posted_at": "2026-09-25T15:35:10.000Z",
"author_url": "https://www.reddit.com/user/block-bit/"
},
{
"url": "https://www.reddit.com/r/node/comments/1wpz65z/comment/pc3jmnu/",
"depth": 0,
"score": 32,
"author": "paulirish",
"excerpt": "node --env-file=.env index.js\n\n Natively supported since Node 20. Not sure why folks are still using dotenv.",
"posted_at": "2026-09-26T02:36:47.000Z",
"author_url": "https://www.reddit.com/user/paulirish/"
},
{
"url": "https://www.reddit.com/r/node/comments/1wpz65z/comment/pc06s89/",
"depth": 0,
"score": 18,
"author": "thicket",
"excerpt": "This article is mostly just an ad for Infisical. That said, I'm glad it's here! The problem of dispersed plaintext secrets is a very real one that any team will run into and ought to be aware of.\n\n For a free, self-hosted solution to the same problem, check out Sigillo, https://github.com/remorses/sigillo",
"posted_at": "2026-09-25T16:51:01.000Z",
"author_url": "https://www.reddit.com/user/thicket/"
},
{
"url": "https://www.reddit.com/r/node/comments/1wpz65z/comment/pc1aoqc/",
"depth": 0,
"score": 14,
"author": "theozero",
"excerpt": "use varlock (free open source)!\n\n .env as most know it is full of footguns. Varlock helps gets all secrets out of plaintext, adds tons of amazing DX while still feeling familiar.",
"posted_at": "2026-09-25T19:42:34.000Z",
"author_url": "https://www.reddit.com/user/theozero/"
},
{
"url": "https://www.reddit.com/r/node/comments/1wpz65z/comment/pc0wjzu/",
"depth": 0,
"score": 6,
"author": "Single_Advice1111",
"excerpt": "Idk… sharing production db credentials outside something that provides access - e.g metabase is a bad practice to begin with…",
"posted_at": "2026-09-25T18:40:11.000Z",
"author_url": "https://www.reddit.com/user/Single_Advice1111/"
},
{
"url": "https://www.reddit.com/r/node/comments/1wpz65z/comment/pc0e6xh/",
"depth": 0,
"score": 3,
"author": "ribugent",
"excerpt": "Personal take, I really dislike all dotenv language libraries because it solves a use case in the wrong place.\n\n Personally in my job we're using direnv for setting environment for \"complex\" setups and fetching some secrets from the vault.",
"posted_at": "2026-09-25T17:21:59.000Z",
"author_url": "https://www.reddit.com/user/ribugent/"
},
{
"url": "https://www.reddit.com/r/node/comments/1wpz65z/comment/pcaafv4/",
"depth": 0,
"score": 1,
"author": "javatextbook",
"excerpt": "There’s no excuse to store credentials in gitignored files when secrets vaults like secrets manager and others, exist",
"posted_at": "2026-09-27T01:42:30.000Z",
"author_url": "https://www.reddit.com/user/javatextbook/"
},
{
"url": "https://www.reddit.com/r/node/comments/1wpz65z/comment/pbznes2/",
"depth": 0,
"score": -3,
"author": "fromage-du-omelette",
"excerpt": "We use infisical in my company. Not a single world where I'd go back to .env files.\n\n Initial moving to it was painful but when you get it, secrets shared among spaces for various services, injection, Integration with ci/cd, man it's a bliss",
"posted_at": "2026-09-25T15:30:06.000Z",
"author_url": "https://www.reddit.com/user/fromage-du-omelette/"
}
],
"evidence": [
"[comment u/ribugent] Personally in my job we're using direnv for setting environment for \"complex\" setups and fetching some secrets from the vault."
],
"link_url": "https://infisical.com/blog/how-environment-variables-work",
"virality": "somewhat_high",
"post_date": "2026-09-25T15:21:59.000Z",
"post_kind": "link",
"sentiment": "positive",
"subreddit": "node",
"post_title": "Your app never reads your .env file (how dotenv actually works)",
"prominence": "aside",
"source_url": "https://www.reddit.com/r/node/comments/1wpz65z/your_app_never_reads_your_env_file_how_dotenv/",
"entity_role": "vendor",
"post_author": "finncmdbar",
"upvote_ratio": 0.639344262295082,
"mention_count": 9,
"mention_surge": true,
"subreddit_url": "https://www.reddit.com/r/node/",
"total_upvotes": 17,
"comments_total": 24,
"total_comments": 24,
"other_companies": [
{
"name": "direnv",
"role": "partner",
"domain": "direnv.net"
}
],
"post_author_url": "https://www.reddit.com/user/finncmdbar/",
"signal_category": "feedback",
"comments_included": 8
}
}
curl https://signals.autobound.ai/v1/signals/2a5f3709-c80b-5dd7-a320-068349fbd9e6 \
-H "X-API-KEY: $AUTOBOUND_API_KEY"curl -X POST https://signals.autobound.ai/v1/companies/enrich \
-H "X-API-KEY: $AUTOBOUND_API_KEY" \
-H "Content-Type: application/json" \
-d '{"domain":"hashicorp.com","limit":20}'Long text fields are shortened on this page.
Looking up one signal by its id is free. Enrich costs 2 credits per signal returned; a call with no results is free.