.tip

May 7, 2026 · one of the small things

Commit .env.example, never .env

The .env file is in .gitignore. The example next to it, with every key and a placeholder value, is committed, and it is the only documentation of the configuration that stays current.

DATABASE_URL=postgres://user:pass@localhost:5432/app
STRIPE_SECRET_KEY=sk_test_...

A startup check that fails when a key in the example is missing from the environment turns a mystery crash into a one-line error.

securitydeveloper-experience

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close