Author SHA1 Message Date
Russell Shean 7df353997d Merge a614252a10 into 52f5a2bf57 2026-09-04 10:17:41 -07:00
Devin Dooley 52f5a2bf57 Merge pull request #4788 from Rubens-Forks/patch-1
Remove trailing spaces and rewrap to 100 columns
2026-09-01 16:28:36 -07:00
Rubén Pérez Alonso a85a4c2ffd Remove trailing spaces and rewrap to 100 columns
Removed 2 trailing spaces and rewrapped the surrounding paragraph to 100
columns, consistent with the rest of the file.
2026-01-21 14:43:36 +01:00
Russell Shean a614252a10 Merge pull request #1 from Russell-Shean/Russell-Shean-patch-1
R: add `.env` to prevent accidentally exposing credentials
2025-12-19 19:30:56 +08:00
Russell Shean 460b9d97a7 R: add .env to prevent accidentally exposing credentials
Historically R users have used the .Renviron file for storing environmental variables such as secrets, credentials, API keys etc. However, I believe there are several compelling reasons for adding .env to the .gitignore too:

1. The dotenv R package was created to allow users to use .env instead of .Renviron. The package has a significant number of downloads.  https://github.com/gaborcsardi/dotenv 

2. .env files are standard in many other programming languages. It wouldn't be that out of the unexpected to think R users might end up with an .env file because a python user on their team contributed files to the repo, the R user started programming in nodejs and is used to working with .env file, or a repo is in the process of being translated from a language that uses .env to R. 

3. LLMs are making programming accessible to people who may not have much previous experience handling credentials and security. One of the first steps many of these users have to do is store LLM provider API keys somewhere. I worry about a new R user adapting a python workflow or an R workflow that recommends using an .env file and then accidentally committing their LLM API keys to a public repo. 

4. I can't think of why an R user would create an .env file for any other reason other than storing credentials and environmental variables. If, for whatever reason, they need to commit an .env file, they can remove that part from the template, but I think the risk of accidentally exposing sensitive credentials justifies adding .env files to the template and not commenting it out by default.
2025-12-19 19:27:15 +08:00
2 changed files with 5 additions and 4 deletions

No files matched your search

+4 -4
View File
@@ -197,10 +197,10 @@ cython_debug/
.abstra/
# Visual Studio Code
# Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
# that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
# and can be added to the global gitignore or merged into this file. However, if you prefer,
# you could uncomment the following to ignore the entire vscode folder
# Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore that
# can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
# and can be added to the global gitignore or merged into this file. However, if you prefer, you
# could uncomment the following to ignore the entire vscode folder
# .vscode/
# Temporary file for partial code execution
tempCodeRunnerFile.py
+1
View File
@@ -38,6 +38,7 @@ vignettes/*.pdf
# R Environment Variables
.Renviron
.env
# pkgdown site
docs/