An environment variable is a named value that your app reads at runtime from its environment rather than from its source code. Secrets like API keys and database URLs are kept in environment variables, usually loaded from a gitignored .env file locally and set in your host's dashboard in production, so the real values never live in your code or git history.
Why not just put secrets in code
A secret written into source is in every copy of the repo forever, including its history, and if the repo is ever public it is scraped within minutes. Reading the secret from an environment variable means the code references a name, process.env.STRIPE_KEY, while the value stays outside the codebase.
The .env and .env.example pattern
Keep real values in a .env that is listed in .gitignore, so it is never committed. Commit a .env.example with the variable names and empty values, so anyone (or any AI tool) can see the shape of the config without seeing the secrets. Confirm .env is gitignored before your first commit.
What this means for AI-generated code
AI tools often create a .env with real values but forget the matching .gitignore entry, so the secrets get committed on the first push. They also inline keys directly when an integration needs one, because that is the shortest path to running code.