env vars and secrets

the string that can spend your money

A production project holds strings with power: the database password, the payment provider's secret key, the token that sends email in your name. Commit one of those to the repo and you've published it; a pushed secret counts as leaked, whatever you delete afterwards, because git history keeps it. The environment variable (a key-value pair configured outside the source code, so the value can differ per environment) exists so those strings live outside the code: the platform docs define them as "key-value pairs configured outside your source code so that each value can change depending on the Environment".