Plaintext .env files are a stupid little footgun. Here’s the SOPS + age + direnv setup I use to keep secrets encrypted, auto-loaded, and out of Git.