A workflow for encrypted .env files using SOPS + age + direnv for the LLM era (opens in new tab)

Plaintext .env files are a stupid little footgun. Here's the SOPS + age + direnv setup I use to keep secrets encrypted, auto-loaded, and out of Git.