StackBlitz .env loads secrets in plain text; secure injection missing

Symptom

StackBlitz automatically loads a repository‑root .env file into process.env for both Node and browser sandboxes, but the file is committed to source control and visible to anyone with project access.

Constraints

• The public sandbox creation API accepts an env object that is transmitted and stored unencrypted.
• Runtime overrides via the UI are transient and disappear on reload, making them unsuitable for automated test runs.
• No documented vault integration or secret‑manager hook exists for injecting credentials securely.

Open questions

1. Is a secure secret‑injection mechanism planned for a future StackBlitz release?
2. Can external secret managers (e.g., HashiCorp Vault, AWS Secrets Manager) be integrated without custom tooling?
3. What are the recommended patterns for CI pipelines that need real credentials without exposing them in the sandbox?