Why .env files are easy to leak
.env files are small, readable, and often copied directly into support threads, docs, or repository issues. That convenience makes it easy to leak API keys, client secrets, passwords, and webhook values by accident.
What should always be masked
Mask any value tied to authentication, cloud services, payments, analytics, email delivery, or internal services. That includes keys such as API_KEY, SECRET, PASSWORD, TOKEN, and provider-specific credentials.