Tools like direnv gets .env files out of repo paths and improves things a lot. You can integrate secrets management in code, but with that there's still no getting away with the assumption that some kind of auth mechanism exists in your env

Wouldn't direnv just mean it will now send up your .envrc file? I think what would work even better is combining direnv with pass[0] so that if it does get uploaded, it will be encrypted. ie:

export SECRET_KEY=$(pass work/secret_key)

[0] https://www.passwordstore.org/

One might use a variation on the idea, like how 1Password does it. Everything in your .env is just a pointer so it's safe to commit.

boring configuration files in ~/.config

hashicorp vault + launch.json on VSCode