Understanding .env files

Laravel applications keep environment-specific settings in a file called .env in the project root: database credentials, the application key, mail settings and API keys.

Rules for a healthy .env

• Never commit it to Git or share it in support tickets; send only the specific value we ask for.
• Keep APP_DEBUG=false on live sites. Debug mode can show configuration values in error pages.
• Back it up with your site. Without the original APP_KEY, encrypted data cannot be read.
• Make sure it is not reachable from the web. Pointing your domain at the public folder takes care of this.

Our installers write .env for you, so most customers never need to open it.