Trying to understand the value of this about ember-cli-dotenv

[duro]

Perhaps just to make it easier for the values to be different for each engineer working on the project locally, and avoid repo conflicts?

[renefs]

For me, this is useful because we have several environments: test, qa, production... and each on of those have different configurations for several things (e.g. different backend locations).

[quantuminformation]

yeah good points

[fivetanley]

So the purpose is not to protect keys, since there is no way to really protect a key in a client side application (at least as far as I'm understanding right now). Basically, for a client side app, the key needs to be a public key any how.

That's right. This addon has the ability to have a safelist for keys (see this section in the README):

security: environment variables in config/environment.js are never filtered unlike using .env and clientAllowedKeys. Remember to use the environment variable passed into your config function to filter out secrets for production usage. Never include sensitive variables in clientAllowedKeys, as these will be exposed publicly via ember's tag.

This addon helps you protect keys by helping you not check them into Git, Github, or other version control systems, which is where keys typically leak out. Instead, you can use a .env file which is not checked into version control.

[fivetanley]

@duro The 12 factor site goes into this in a bit better detail https://12factor.net/config