Having them in plaintext always seemed like a bad idea. Forget agents accidentally reading . env; any random package you get from the AUR can trivially read all your keys.

Source: [Hacker News](https://news.ycombinator.com/item?id=49668727)

Sponsored