Why It Matters
Environment variables keep sensitive information such as passwords, API keys and secret tokens out of your codebase. If these values were hard-coded into the source files, anyone with access to the repository would also have access to your production credentials, and changing a value would require a code change and redeployment. Environment variables separate configuration from code, which means the same application code can run in different environments (development, staging, production) simply by changing the variables. They are also a fundamental security practice. Leaked source code on its own is embarrassing but survivable. Leaked source code with embedded database passwords and an API key is a breach.
Example
Your web application connects to a payment provider using an API key. In the development environment, the environment variable holds a test key that processes fake transactions. In production, it holds the live key that processes real payments. When a new developer joins and sets up the project locally, they configure their own environment variables pointing to the test key. They can develop and test payment flows without any risk of charging real customers or needing access to production credentials. Getting these values set correctly across servers is part of our infrastructure support work.
