I think using a secret manager like https://onboardbase.com solves this easily. .envs are never in the codebase.