Dev secrets can now live in git. plain env set encrypts a value into your committed .env.dev, one key per project. A fresh clone — or a hosted agent sandbox — just needs DEV_ENV_KEY and every dev credential comes with the repo.