.env files are wild to me, environment variables have never been a good way to pass data to applications, let alone secret data.

So the solution people came up with was to store them in plain text next to the binary, and then have a loader apply them before running the main app.