I Built a Zero-Config Secret Manager in Rust Because .env Files Are Security Theater

I Built a Zero-Config Secret Manager in Rust Because .env Files Are Security Theater Every time I onboard a new developer, the instructions include: "Ask someone for the .env file. Don't commit it." That's it. That's our secret management strategy. A file we pass around on Slack. We've all been there. A .env ends up in a repo. Or in a Slack message. Or gets pasted into a Notion doc for "convenience." Then six months later you're rotating every credential you own because someone found it in a git log. The problem isn't that developers are careless. The problem is that .env files are the path of least resistance — and they're fundamentally insecure by design. The Real Problems with .env Let me be specific about what's wrong: 1. They're plaintext. Your DATABASE_URL sits in a text file on your disk, next to your code. If your laptop is compromised, all your secrets are too. 2. They travel through insecure channels. How do new devs get them? Slack DMs. Email. Sometimes a Google Doc. These a