--- title: "How to Securely Deliver a Config File to a Developer" url: https://uselinkpilot.com/blog/how-to-securely-deliver-a-config-file-to-a-developer description: "Split settings from secrets, send the secret values through a one-time link or an attachment that burns after one download, and keep the .env out of git." lang: en --- Security (https://uselinkpilot.com/blog/category/security) # How to securely deliver a config file to a developer Split settings from secrets, send the secret values through a one-time link or an attachment that burns after one download, and keep the .env out of git. LinkPilot Team (https://uselinkpilot.com/author/linkpilot-team) · The people who build and run LinkPilot at TetraCore, LLC October 26, 2026 · About LinkPilot (https://uselinkpilot.com/about) A new developer joins, or a contractor starts, and the first thing they need is the `.env` that makes the project run. That file is usually a mix of harmless settings and the most sensitive values the team owns, which is why it so often ends up in a direct message or an email attachment titled "config". To securely deliver a config file to a developer, treat it as two things: settings, which can travel anywhere, and secrets, which travel once through a channel that keeps no copies. This guide covers how to split the two, how to send the secret half, and what to tell the developer so the file stays safe after it lands. ## Read the file as if every line were public Open the file and sort each line into one of two groups. - **Settings**: log levels, ports, feature flags, non-production endpoints, public client IDs. These belong in the repository as an example file and can be sent any way you like. - **Secrets**: database passwords, API (https://uselinkpilot.com/glossary#api) keys, signing secrets, private keys, OAuth (https://uselinkpilot.com/glossary#oauth) client secrets, anything that grants access. Search for `PASSWORD`, `SECRET`, `TOKEN`, `KEY` and `PRIVATE`, and then read the rest, because a connection string with the password embedded does not announce itself. Then ask what the developer is doing. Local development against staging needs the staging values. It does not need production keys, and it does not need the payment provider's live key just because the file happens to contain one. ## Keep secrets out of the committed file The committed `.env.example` documents every variable with a placeholder. The real values are injected at runtime from the environment, a secrets manager or the platform's own secret store. That pattern means the file you deliver is only the secret values, and the developer's local copy is the only place they exist together. ```bash # .env.example (committed) DATABASE_URL=postgres://app:CHANGE_ME@staging-db.internal:5432/app STRIPE_SECRET_KEY=sk_test_CHANGE_ME SESSION_SECRET=CHANGE_ME LOG_LEVEL=debug ``` Add `.env` to `.gitignore` before anyone has a real one, and consider a pre-commit hook such as gitleaks so a stray commit fails fast. ## Give the developer their own credentials where you can A handoff is also a chance to stop sharing. If the database supports individual users, create one for the developer with the permissions their work needs and an expiry date (https://uselinkpilot.com/glossary#expiry-date). If the API offers restricted keys, issue one in their name. The contractor database login guide (https://uselinkpilot.com/blog/how-to-send-a-temporary-database-login-to-a-contractor-securely) covers that pattern. Credentials made for one person can be removed for one person. ## How to deliver the secret values Two routes work, and both avoid leaving the file in a message. **Paste the secret lines into a one-time link (https://uselinkpilot.com/glossary#one-time-link).** Open the secret link tool (https://uselinkpilot.com/tools/free-secret-link-generator), paste only the lines that contain secrets, and create the link. The text is encrypted in your browser before it is stored, the stored copy is destroyed the first time the link is opened, and the link expires after one hour, 24 hours or seven days if nobody opens it. Up to 10,000 characters fit without an account, which covers most `.env` files several times over. **Attach the whole file to a secret link (https://uselinkpilot.com/glossary#secret-link).** From a signed-in LinkPilot account you can attach up to three files of 9 MB each to a secret. Each file is encrypted in your browser with a key derived from the secret's own key, so the server never holds the plain file, and the attachment is deleted after the single download. This is the better route when the file has to arrive byte-for-byte, for example a JSON service account file or a keystore. Either way: 1. **Verify the developer** through the hiring or contract channel, not the address that asked for the file. 2. **Set the expiry** to the window they will actually use. One hour if they are waiting, a day if they are in another time zone. 3. **Set the view limit to one.** 4. **Add a passphrase on a Pro account** for production values, and send it by a different channel. 5. **Send the link with a one-line note** of what it is and where the file belongs. Send the non-secret settings separately or point at the example file in the repo. A vault invitation is the better route when the developer is a permanent hire and your team already runs a secrets manager with per-developer access. Use the one-time link for the gap before that is set up, and for anyone who will never be in the vault. ## Tell the developer where it belongs A clean delivery can still end badly if the file lands in a shared folder. Send these with the connection details: - **Save it as `.env` in the project root** and nowhere else. Check it is covered by `.gitignore` before the first commit. - **Do not paste values into tickets or chat** to ask whether they are right. Report a missing or invalid variable by name only, and the sender will issue a fresh value. - **Rotate on departure.** When the engagement ends, the values in that file get rotated. Say so up front, so nobody is surprised. ## Confirm, then clean up Ask the developer to confirm the filename, the environment and a non-secret marker, such as a version comment in the first line. If a one-time link reports that it was opened before they got to it, treat every value in it as exposed and rotate. When the handoff is complete, revoke any link that was never opened, remove any temporary storage copy you made, and record who received which environment's values and when. The record is the audit trail (https://uselinkpilot.com/glossary#link-history). The file itself should exist only on the machine that needs it. ## Related reading - How to share API keys securely: https://uselinkpilot.com/blog/how-to-share-api-keys-securely - Secure link sharing for developers: https://uselinkpilot.com/blog/secure-link-sharing-for-developers - How to create a temporary secure link for sharing files: https://uselinkpilot.com/blog/how-to-create-a-temporary-secure-link-for-sharing-files - How one-time secret links work: https://uselinkpilot.com/blog/how-one-time-secret-links-work ## Tools for this article One-Time Secret Link Generator Share a password or note through a link that opens once. https://uselinkpilot.com/tools/free-secret-link-generator Self-Destructing Message Send a note that disappears after one read. https://uselinkpilot.com/tools/burn-after-read-secret Expiring Link Generator Create links that stop working at a set time. https://uselinkpilot.com/tools/temporary-link ## Frequently asked questions ### Is it safe to send a config file by email? ### Should secrets be stored in the config file at all? ### What is the safest way to share a .env with a contractor? ### Should I encrypt a config file before sharing it? ### How do I confirm the developer got the right file? ### What if I sent the file to the wrong person? ## LinkPilot sends a secret link that is gone after it is opened. Encrypted in your browser, revealed once, then destroyed. No account needed. Create a secret link (https://uselinkpilot.com/tools/free-secret-link-generator) ## Read next Security ### How to Implement Secure Secret Sharing for Remote Teams Secure secret sharing for remote teams in five steps: inventory, vault or one-time link by lifespan, three rules, the tool inside Slack, and a plan for leaks. https://uselinkpilot.com/blog/how-to-implement-secure-secret-sharing-for-remote-teams Security ### How to Create a Secure Way to Hand Off Credentials Between Teams A secure way to hand off credentials between teams: pick vault or one-time link by how the credential is used, scope it, name an owner and revoke on time. https://uselinkpilot.com/blog/how-to-create-a-secure-way-to-hand-off-credentials-between-teams Security ### Cloud Secret Manager: What It Is, How to Choose One, and What It Doesn't Cover What a cloud secret manager stores and protects, how to choose between AWS, Google, Azure and Vault, how to roll one out, and the human handoff gap it leaves. https://uselinkpilot.com/blog/cloud-secret-manager ## Structured data ```json [ { "@context": "https://schema.org", "@type": "SoftwareApplication", "@id": "https://uselinkpilot.com/#software", "name": "LinkPilot", "applicationCategory": "BusinessApplication", "operatingSystem": "Web", "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.", "url": "https://uselinkpilot.com", "offers": [ { "@type": "Offer", "name": "Free", "price": "0", "priceCurrency": "USD", "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Pro", "price": "29", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "29", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Agency", "price": "299", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "299", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Agency Plus", "price": "799", "priceCurrency": "USD", "priceSpecification": { "@type": "UnitPriceSpecification", "price": "799", "priceCurrency": "USD", "billingDuration": "P1M" }, "url": "https://uselinkpilot.com/pricing" }, { "@type": "Offer", "name": "Enterprise", "priceSpecification": { "@type": "PriceSpecification", "priceCurrency": "USD" }, "url": "https://uselinkpilot.com/pricing" } ] }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://uselinkpilot.com/#organization", "name": "LinkPilot", "alternateName": "LinkPilot by TetraCore", "url": "https://uselinkpilot.com", "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "email": "support@uselinkpilot.com", "url": "https://uselinkpilot.com/support" }, "parentOrganization": { "@type": "Organization", "@id": "https://tetracorehq.com/#organization", "name": "TetraCore", "url": "https://tetracorehq.com/" }, "logo": { "@type": "ImageObject", "url": "https://uselinkpilot.com/logo-512.png", "width": 512, "height": 512 }, "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.", "sameAs": [ "https://x.com/uselinkpilot", "https://www.linkedin.com/company/uselinkpilot", "https://facebook.com/uselinkpilot", "https://github.com/TetraCoreHQ/linkpilot-cli", "https://github.com/TetraCoreHQ/linkpilot-mcp", "https://www.npmjs.com/package/linkpilot", "https://www.npmjs.com/package/@uselinkpilot/sdk", "https://www.npmjs.com/package/@uselinkpilot/mcp", "https://chromewebstore.google.com/detail/linkpilot-short-links-and/mnmppadihpcncicldpkmgknhnjkondad" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "LinkPilot", "url": "https://uselinkpilot.com", "potentialAction": { "@type": "SearchAction", "target": "https://uselinkpilot.com/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://uselinkpilot.com/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://uselinkpilot.com/blog" }, { "@type": "ListItem", "position": 3, "name": "How to Securely Deliver a Config File to a Developer", "item": "https://uselinkpilot.com/blog/how-to-securely-deliver-a-config-file-to-a-developer" } ] }, { "@context": "https://schema.org", "@type": "BlogPosting", "@id": "https://uselinkpilot.com/blog/how-to-securely-deliver-a-config-file-to-a-developer#article", "headline": "How to Securely Deliver a Config File to a Developer", "description": "Split settings from secrets, send the secret values through a one-time link or an attachment that burns after one download, and keep the .env out of git.", "datePublished": "2026-10-26", "dateModified": "2026-10-26", "image": "https://uselinkpilot.com/logo-512.png", "author": { "@type": "Organization", "@id": "https://uselinkpilot.com/author/linkpilot-team#organization", "name": "LinkPilot Team", "url": "https://uselinkpilot.com/author/linkpilot-team" }, "publisher": { "@type": "Organization", "name": "LinkPilot", "url": "https://uselinkpilot.com", "logo": { "@type": "ImageObject", "url": "https://uselinkpilot.com/logo-512.png", "width": 512, "height": 512 } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://uselinkpilot.com/blog/how-to-securely-deliver-a-config-file-to-a-developer" } }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is it safe to send a config file by email?", "acceptedAnswer": { "@type": "Answer", "text": "Not if it contains live secrets. Email keeps copies in both mailboxes, every synced device and the backups behind them. Send the secret values through a one-time link and keep email for the non-secret settings." } }, { "@type": "Question", "name": "Should secrets be stored in the config file at all?", "acceptedAnswer": { "@type": "Answer", "text": "Only when the application requires it. Prefer placeholders in the committed file and inject the real values from the environment or a secrets manager at runtime. The committed example file documents the shape; the secret values travel separately." } }, { "@type": "Question", "name": "What is the safest way to share a .env with a contractor?", "acceptedAnswer": { "@type": "Answer", "text": "Verify them, give them their own credentials scoped to the environment they need, send those values through a one-time link, and tell them where the file belongs and that it must never be committed." } }, { "@type": "Question", "name": "Should I encrypt a config file before sharing it?", "acceptedAnswer": { "@type": "Answer", "text": "If you attach it to a LinkPilot secret link it is encrypted in your browser before upload and destroyed after one download, so no separate step is needed. If you use another channel, encrypt it with a tool such as age or a password-protected archive and send the passphrase by a different route." } }, { "@type": "Question", "name": "How do I confirm the developer got the right file?", "acceptedAnswer": { "@type": "Answer", "text": "Ask them to confirm the filename, the environment and a non-secret marker such as a version comment at the top. Never ask them to send the contents back." } }, { "@type": "Question", "name": "What if I sent the file to the wrong person?", "acceptedAnswer": { "@type": "Answer", "text": "Rotate every secret in it at the systems that accept them, then update the deployments that used the old values. The file itself cannot be recalled." } } ] } ] ```