Environment variable
Also known as: env var, environment variables, env variable
An environment variable is a named value stored by the operating system that programs can read to learn about their surroundings, such as where to find other programs (PATH), the user's home folder, or which database to connect to.
Developers use environment variables to keep configuration and secrets such as API keys out of their code. While environment variables are simple and universal, accidentally leaking them, such as by committing a .env file to a public code repository, is a common cause of breaches.
Environment variable, explained at three levels
At home
Environment variables are like sticky notes on a fridge that every family member can read, saying things like 'groceries are in the garage.' Programs read them to find what they need.
At work
Environment variables let software use different settings in testing and production without changing the code.
At home
If a program says 'command not found,' it may not be in your PATH variable. Installers often add programs to PATH automatically.
At work
Developers store database addresses, feature flags, and API keys in environment variables, often loaded from .env files locally and secrets managers in production.
At home
Never share screenshots of your terminal or code that show API keys. In my opinion, treat any key you've accidentally posted as compromised and create a new one.
At work
Add .env files to .gitignore, use secrets managers rather than plain environment variables for sensitive values where possible, enable secret scanning, rotate exposed keys immediately, and avoid logging environment contents.
Real-world examples
At home
Sophie installed Python but got 'command not found.' Adding Python's folder to her PATH environment variable fixed it.
At work
Marcus reviews code at a Calgary startup. He found an API key committed in a .env file, rotated it, and added secret scanning to the repository.
Common confusions
- Environment variables are a secure place to store secrets. — They're better than hard-coding, but can leak through logs, crash reports, or child processes. Secrets managers are safer.
- Deleting a leaked key from code fixes the problem. — The key remains in version history and may already be copied. It must be revoked and replaced.
For analysts
I'd include secrets handling in development standards. A single leaked API key can expose customer data or rack up large cloud bills overnight.
History & origin
Environment variables appeared in Version 7 Unix in 1979 and were later adopted by MS-DOS and Windows, where variables such as PATH told the system where to look for programs. The 'Twelve-Factor App' guidelines, published by Heroku co-founder Adam Wiggins in 2011, recommended storing configuration in environment variables, which became standard in cloud and container development. Tools such as dotenv files made local development easier. As code hosting grew, leaked secrets in repositories became a major problem, and GitHub expanded secret scanning to automatically detect exposed keys. In my view, environment variables are a tiny feature with a big security footprint.