# Secrets

> croft docs secrets: Secrets

croft reads secrets from <project>/.env itself; Bun's automatic .env loading is off.

- A variable set in the shell environment wins over .env (an empty one does not).
- .env.local and other .env.\* files are ignored, with the warning ENV_FILE_IGNORED.
  (.env.example, .env.sample and .env.template are templates and are not reported.)
- An asset lists the names it needs in secrets: ["STRIPE_KEY"] and reads them with ctx.secret("STRIPE_KEY").
  Other names are refused, and a missing value is SECRET_MISSING. Values never go into process.env.
- Every .env value of 4 or more characters is replaced with [redacted:NAME] in croft's messages and logs.
  In command data (query rows, samples) only declared secrets and values that look like credentials
  (8+ characters, not only letters or only digits) are replaced, so PORT=5432 or LOG_LEVEL=info do not
  rewrite ordinary values; data that had a value replaced carries redactedValues: true.
- croft secrets --json lists each declared name as set or missing, where it came from, and which assets
  use it, without printing values.

.env syntax: KEY=value per line; # comments (inside an unquoted value only after a space); an optional
export prefix; 'single' and `backtick` quotes are literal; "double" quotes understand \n \r \t \" \\;
quoted values may span lines. There is no ${VAR} expansion.

Agents: never read .env. Ask the user to add NAME=... to .env, or to run croft secrets set NAME in
their own terminal.

The same page is in the CLI: `croft docs secrets`.

Source: https://croft.zabaca.com/docs/guides/secrets/