985: Stop putting secrets in .env

The podcast explores the security risks associated with storing secrets in `.env` files and introduces Varlock as a solution. It addresses the common practice of using `.env` files due to readily available tutorials, while highlighting the dangers of exposing plain text secrets to AI coding agents. Varlock unifies schema information and values into a single file, using JS doc-style comments for validation and declarative function calls to fetch secrets from various sources like 1Password, AWS, and GCP. The tool supports a .env.schema file that can be committed to a repo, offers type declarations, and allows flexible secret exposure methods. Phil Miller and Theo Ephraim, developers of Varlock, emphasize its ability to centralize secret management, prevent leaks, and integrate with different frameworks, making it useful for both solo developers and large teams.