---
title: "Using .env Files: Risks of Hardcoding Secrets"
description: "Learn how to secure apps using .env files, avoid hardcoding secrets, and the lessons from recent HGS and Anadolu Sigorta cyberattacks in Turkey."
slug: "using-env-files-risks-of-hardcoding-secrets"
url: "https://furkanbaytekin.dev/blogs/using-env-files-risks-of-hardcoding-secrets"
author: "Furkan Baytekin"
category: "Software"
tags: []
published: 2025-01-02T08:26:25Z
updated: 2025-01-02T08:26:25Z
readTime: 3
cover: "https://myblogcms.furkanbaytekin.dev/uploads/cover/using-env-files-risks-of-hardcoding-secrets+1735750543049"
---

In the world of software development, managing sensitive information like API keys, database credentials, and other secrets is crucial for security. Let’s dive into the proper use of `.env` files, the dangers of hardcoding secrets, and recent cyberattacks in Turkey involving HGS and Anadolu Sigorta.

## What Are `.env` Files?

`.env` files store environment variables, which are used to configure applications. These files are often excluded from version control systems (e.g., `.gitignore`) to prevent sensitive data from being exposed to unauthorized users. Instead of embedding secrets directly into the codebase, developers reference these variables, ensuring a cleaner and safer approach to configuration management.

## Benefits of `.env` Files

* **Security:** Secrets are not hardcoded into the source code.
* **Environment-Specific Configurations:** Easily switch between development, staging, and production environments.
* **Avoiding Accidental Exposure:** Prevent sensitive information from being included in public repositories.

## Risks of Hardcoding Secrets

Hardcoding secrets—directly embedding credentials and other sensitive information into the source code—can lead to disastrous consequences:

- **Exposure to Unauthorized Access:** If your code is accidentally pushed to a public repository or accessed by unauthorized personnel, secrets can be easily compromised.
- **Static Vulnerabilities:** Hardcoded credentials are static and cannot be rotated easily. If they are leaked, the impact can be long-lasting.
- **Difficult Maintenance:** Updating a secret requires code changes and redeployments, making maintenance cumbersome and prone to errors.

## Recent Cyberattacks in Turkey

### HGS (High-Speed Toll Collection System) Attack

In December 2024, the HGS mobile app in Turkey was hacked. Attackers sent offensive notifications to users and demanded Bitcoin payments. Although PTT, the operator of HGS, confirmed the attack, they stated that user data was secure.

### Anadolu Sigorta Attack

Similarly, the Anadolu Sigorta app was compromised. Users received vulgar messages and cryptocurrency demands through app notifications. These attacks underline the importance of robust security measures in software systems.

## What Went Wrong?

While the exact vulnerabilities exploited in these cases remain unclear, such incidents often stem from:

- Poor handling of environment variables.
- Hardcoded credentials left exposed in public repositories.
- Insufficient encryption of sensitive data.

## Best Practices to Secure Secrets

- **Always Use `.env` Files:** Keep sensitive information out of your source code and store it in `.env` files.
- **Exclude `.env` from Version Control:** Add `.env` to your .gitignore file to ensure it isn’t accidentally pushed to repositories.
- **Utilize Secret Management Tools:** Tools like AWS Secrets Manager, HashiCorp Vault, or GitHub Actions Secrets provide additional layers of protection.
- **Encrypt Sensitive Data:** Always encrypt secrets, both in transit and at rest.
- **Monitor and Rotate Secrets Regularly:** Periodically update credentials and monitor for unauthorized access attempts.

## Conclusion

The recent cyberattacks in Turkey serve as a wake-up call for organizations to reevaluate their security practices. By leveraging `.env` files and avoiding hardcoded secrets, developers can significantly reduce vulnerabilities in their systems. Cybersecurity is not just about tools—it’s about cultivating a culture of vigilance and best practices in every stage of development.

Stay safe, and remember: your security is only as strong as your weakest link.