Guides
The awkward parts of working with environment variables — the ones that usually get solved with a Slack DM and a quiet hope that nobody scrolls back.
Handling secrets
Why Slack and email are the wrong pipe, what a safe hand-off actually needs, and three ways to do it — including one that needs no account on the other end.
You committed .env. Rewriting history is the second thing to do — this is the first, and the order matters more than the commands.
Syncing environments
Pull what is already in your Vercel project into a single source of truth, and keep local, preview and production from drifting apart.
Move Railway's variables into version-tracked storage, and get them onto a new laptop without a copy-paste session.
Import a Render service's environment, then keep the local .env and the deployed one honest about their differences.
Migrating in
Projects and configs map onto Sink's projects and environments almost directly, so nothing gets renamed on the way in.
Authenticate as a machine identity, pick a region and a secret path, and import one environment at a time.
The read-only IAM policy to use, how myapp/prod/db-password becomes a variable name, and what happens to secrets holding JSON.
Register an app, give it Key Vault Secrets User, and import a vault — including why the vault name is typed rather than picked.