Configuration and Environments

Legacy apps frequently hard-code database passwords and URLs in config.php committed to Git, with different copies per server. Move secrets into environment variables (or a .env file loaded with vlucas/phpdotenv in development), keep a committed .env.example, validate required settings at startup, and rotate any credentials that were ever committed.

<?php
// bootstrap.php
require __DIR__ . '/vendor/autoload.php';

if (file_exists(__DIR__ . '/.env')) {
    Dotenv\Dotenv::createImmutable(__DIR__)->load();
}

$required = ['DB_DSN', 'DB_USER', 'DB_PASSWORD', 'APP_ENV'];
foreach ($required as $key) {
    if (empty($_ENV[$key] ?? getenv($key))) {
        throw new RuntimeException("Missing configuration: {$key}");
    }
}

Common pitfalls

• Leaving old credentials in Git history after moving them out.
• Production behavior differing because of untracked per-server config files.
• Displaying configuration errors with secrets to users.

Key points

• Secrets in environment, not Git
• Validate config at startup
• Rotate previously committed credentials

Further reading: The Twelve-Factor App: Config