You can commit your secrets as an encrypted vault with this. Then decrypt it with a key where needed: locally, on CI, on prod, etc.

This is basically a simplified version of Hashicorp's Vault, GCP key vault etc. with some less granularity on user authentication.

It solves the issues around .env.example and is perfect for gitops. You have all your secrets for all your envs ready, while you only need to set a single env var (the private encrpytion key) on your specific hosting environment.

You could even use separate keys per env, eg.: to give access to a developer to staging only.

Mozilla's https://github.com/getsops/sops is another contender but with a more complicated (and perhaps more flexible) key management.