Plain now has its own .env parser with command substitution support.

Fetch secrets from 1Password during local dev:

SECRET_KEY=$(op read "op://Dev/App/secret_key")

No more plaintext secrets in .env files for Claude to accidentally read.