// HACKER NEWS — CYBERSECURITY
We Are Forking dotenvy into dotenv-ng
We have released dotenv-ng 1.0, a
modern Rust implementation for loading and rendering .env files. It began as
a fork of dotenvy after its parser
changed a secret while reading it.
That may sound contradictory. SecretSpec is still on a mission to eliminate
environment variables as a secrets
interface, and we have written about
where .env went wrong. It should not be the
final home of a secret.
But migrating away from .env starts with reading it
correctly.
The immediate failure was SecretSpec issue
#73. A dotenv file contained a
value with bcrypt fragments:
The file was intact. Reading it through the dotenv provider returned a
different value because dotenvy treated the dollar-prefixed fragments as
variable substitutions. The failure appeared later as an authentication error,
not a parse error.
An upstream request to make substitution configurable had been open since
2024. A pull
request arrived in 2026 but
targeted an unreleased API. A migration tool cannot require users to recognize
and escape parser syntax inside their secrets.
The original Rust dotenv crate stopped releasing in 2020 and was eventually
marked unmaintained by
RustSec, which listed
dotenvy as an alternative.
Dotenvy’s description still calls it “a well-maintained fork.” Its latest
published version, 0.15.7, was released on March 22,
2023. A Rust forum
discussion
noted the two-year release gap in 2025. By the time the bcrypt bug blocked
SecretSpec, it was more than three years.
There is an uncomfortable irony in a maintained fork repeating its upstream’s
release problem. Its maintainers do not owe us a release, but SecretSpec needed
breaking fixes on a schedule we control.
We first considered a small patch. Auditing the parser uncovered more problems
around JSON, Windows paths, Unicode names, precedence, and partial environment
mutation.