Cach chia se file .env va bien moi truong an toan voi team

"De anh gui qua Zalo cho"

Mot developer moi vao team. Dang setup moi truong local thi hoi:

"Anh oi, cho em xin file .env duoc khong?"

Chuyen gi xay ra tiep thi ai cung biet. Mot anh senior mo Zalo hoac Slack, copy nguyen noi dung file .env — mat khau database, API key, secret cua cac dich vu ben thu ba — roi paste vao tin nhan. Tin nhan do nam o lich su chat mai mai.

Ai cung da tung lam viec nay. Va no nguy hiem hon nhieu so voi nhung gi chung ta nghi.

Tai sao khong nen chia se file .env tuy tien

File .env chua day nhung thong tin nhay cam:

• Thong tin ket noi database — host, port, username, password
• API key — Stripe, AWS, Firebase va cac dich vu tinh phi neu bi lam dung
• Secret cua ben thu ba — OAuth client secret, webhook signing key
• Token noi bo — token xac thuc giua cac microservice

Khi ban paste nhung thu nay vao Zalo hay Slack, du lieu duoc luu tren server cua ho. Bat ky ai co quyen truy cap workspace deu co the tim thay chung qua chuc nang search, ke ca nhieu thang hoac nhieu nam sau. Neu dien thoai bi mat, nhung credential do cung di theo.

Nhung cach chia se pho bien (nhung nguy hiem)

Cach	Rui ro
Zalo / Slack DM	Luu vinh vien tren server, co the search duoc
Dinh kem email	Luu tren mail server, co the chuyen tiep
Google Docs chia se	Link bi lo la ai cung truy cap duoc, lich su chinh sua con giu noi dung
Commit vao Git	Xoa roi van con trong git log, bot quet GitHub trong vai giay
Notion / Confluence	Toan bo thanh vien workspace co the search thay

Truong hop commit vao Git la nguy hiem nhat. Co nhung bot tu dong lien tuc quet cac repository cong khai tren GitHub. Neu ban vo tinh push file .env, API key cua ban co the bi compromise trong vai phut.

Cach chia se file .env an toan

1. Secret Manager

Doppler, HashiCorp Vault, AWS Secrets Manager la nhung cong cu chuyen dung cho viec nay. Chung quan ly tap trung cac bien moi truong, cung cap kiem soat truy cap chi tiet, audit log va tu dong rotate key. Neu team ban co nhieu developer, day la lua chon ly tuong.

2. Password Manager cho team

1Password Teams va Bitwarden Organization ho tro shared vault de luu noi dung .env duoi dang secure note. Chi thanh vien duoc cap quyen moi xem duoc, moi thu deu duoc ma hoa end-to-end.

3. Memo co mat khau va tu huy

Khi can chia se nhanh mot lan — nhu luc onboard developer moi — LOCK.PUB la cong cu phu hop. Ban paste noi dung .env vao memo bi mat, dat mat khau va thoi han het han, roi gui link qua Slack va mat khau qua Zalo (hoac goi dien). Khi het han, noi dung tu dong bien mat — khong de lai bat ky ban ghi vinh vien nao.

4. File ma hoa GPG

Voi nhung team yeu cau bao mat cao, ban co the ma hoa file .env bang GPG truoc khi chia se. Nhuoc diem la moi thanh vien deu phai biet quan ly GPG key, dieu nay tao them ma sat.

Best practice quan ly .env

1. Them .env vao .gitignore ngay lap tuc — Day la viec dau tien can lam khi tao project moi.
2. Duy tri file .env.example — Su dung gia tri placeholder de developer moi biet can nhung bien nao.
3. Dung credential khac nhau cho moi moi truong — Dev, staging va production khong bao gio dung chung key.
4. Rotate secret thuong xuyen — It nhat moi quy mot lan.
5. Thu hoi quyen khi co nguoi roi team — Khi mot thanh vien nghi viec, rotate tat ca secret ma nguoi do da co quyen truy cap.

Setup nhanh: .gitignore + .env.example

Them dong nay vao .gitignore ngay bay gio:

# Bien moi truong
.env
.env.local
.env.*.local

Sau do tao .env.example lam tai lieu:

# .env.example
DATABASE_URL=postgresql://user:password@localhost:5432/mydb
STRIPE_SECRET_KEY=sk_test_xxxxxxxxxxxx
FIREBASE_API_KEY=your_firebase_api_key_here
NEXT_PUBLIC_BASE_URL=http://localhost:3000

Commit file nay vao repo. Developer moi se biet ngay can nhung bien gi ma khong lo lo gia tri that.

Ngung gui secret bang van ban thuong

Chia se file .env co ve la chuyen nho, nhung no la mot trong nhung nguyen nhan pho bien nhat gay lo credential. Du ban dau tu vao secret manager chuyen nghiep hay dung LOCK.PUB de chia se credential voi thoi han het han, dieu quan trong la bo thoi quen paste secret vao tin nhan chat.

Thu ngay bay gio: search DATABASE_URL hoac API_KEY trong nhom Zalo hoac Slack cua team ban. Ket qua co the se khien ban bat ngo.