I stopped using “.env.local”, how are you managing secrets in your projects?

My main issue with ".env.local" was that it became increasingly annoying when working across multiple projects, environments, or contributing to someone else's codebase. Now, I can keep secrets organized by project/environment and inject them at runtime with a single command, without storing them directly in the project files.

Another reason is AI coding agents. Tools like Claude Code, Cursor, Codex, etc. can access a large part of the codebase, and having secrets sitting in ".env.local" feels like unnecessary exposure. Of course, runtime injection doesn't completely prevent an agent with shell access from accessing environment variables, but it reduces accidental exposure and gives much better control over which secrets are available to each project/environment.

I'm curious how others are handling this: Are you still using .env / .env.local, or have you moved to a secrets manager? And if so, which one?