.env is excluded from Git (listed in .gitignore) — secrets do not leakKeep a .env.example in the repository with all keys but no values — new developers will know what to configure. In CI/CD, inject variables via the provider's UI, not via files.
Storing configuration in environment variables is one principle of the 12-Factor App methodology — a set of practices for building scalable cloud applications.