Update adding-custom-environment-variables.md

[albingroen]

.env files should not be checked into source control (with the exclusion of .env*.local).

[facebook-github-bot]

Hi @albingroen!

Thank you for your pull request and welcome to our community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file.

In order for us to review and merge your code, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

If you have received this in error or have any questions, please contact us at [email protected]. Thanks!

[petetnt]

Hi @albingroen!

In the context of Create React App, the suggestion of committing .env files to the repository is correct (if not a bit controversial).

All the environment variables read from the the .env files by Create React App are prefixed with REACT_APP_ and will end up in the final bundle making them completely public. Thus committing .env files filled with REACT_APP prefixed environment variables to the version control is the best practice, as they are essentially available for everyone anyways.

.env.local* files (in CRA context) are meant for overriding the defaults and should not be committed to the repo.

Obviously the situation will get trickier if the same .env file is shared with (for example) a custom backend, in which case the file might contain private values and should not be committed to the repo.

[albingroen]

Hi @albingroen!

In the context of Create React App, the suggestion of committing .env files to the repository is correct (if not a bit controversial).

All the environment variables read from the the .env files by Create React App are prefixed with REACT_APP_ and will end up in the final bundle making them completely public. Thus committing .env files filled with REACT_APP prefixed environment variables to the version control is the best practice, as they are essentially available for everyone anyways.

.env.local* files (in CRA context) are meant for overriding the defaults and should not be committed to the repo.

Obviously the situation will get trickier if the same .env file is shared with (for example) a custom backend, in which case the file might contain private values and should not be committed to the repo.

Ah I see now, this makes sense. My bad!