How to Keep Dev Secrets Off Disk Using Bitwarden and direnv

Developers commonly store sensitive credentials like API keys and database passwords in plaintext files such as .env or shell profiles, leaving them vulnerable to malware, accidental commits, or stolen hardware. The core risk is that these secrets sit permanently decrypted on disk without requiring any identity verification at the time of use. A more secure alternative involves storing secrets in an encrypted password manager like Bitwarden and using the direnv tool to inject them as environment variables only when inside a specific project directory. This combination means credentials are never written to disk in plaintext — they exist only in memory for the duration of a shell session, unlocked via a master password prompt. The same pattern can be applied to any type of secret by adjusting the Bitwarden item name and the environment variables being exported.