StackBlitz .env loads secrets in plain text; secure injection missing
Symptom StackBlitz automatically loads a repository‑root .env file into process.env for both Node and browser sandboxes, but the file is committed to source control and visible to anyone with project access. Constraints The public sandbox creation API accepts an env object that is transmitted and stored unencrypted. Runtime overrides via the UI are transient