.env for secrets. If the repository is public, anything in a committed .env is readable by anyone and must be treated as compromised — make the repo private, or move the secrets to App → Settings → Environment Variables and rotate whatever was already pushed.
.env committed in the repository is not read by Incolis — do not rely on it, and if the repo is public it is still readable.