Your .env Is Not a Vault: Five Secret-Handling Myths and a Three-Place Scanner

A few weeks ago I put an API key in a .env file on a free server. Then I asked a dull question. Who...