What are environment variables?
Environment variables are named values that live in an app's runtime environment rather than in its code. The code references a name like OPENAI_API_KEY; the actual value is supplied by the environment where the app runs, whether that's the builder's machine or the hosting platform's settings.
Locally they're often collected in a .env file; in production they're entered in the hosting dashboard. Same names, different values per environment, which is also how one codebase can point at a test database in development and the real one in production.
Why do environment variables matter for security?
They're the standard answer to where secrets belong. Code gets shared, committed to repositories, and shipped to browsers; environment variables don't travel with it. An API key in an environment variable stays on the server, while a hardcoded one goes wherever the code goes.
AI tools sometimes hardcode values when wiring an integration quickly, so the habit worth keeping is a quick check (or an audit prompt) confirming that every key and password is referenced by name, not written out.
