Environment variables in production

Environment variables store sensitive data like API keys and database URLs outside your code. Never hardcode secrets, and never commit them to GitHub.

# .env file (never commit this)
DATABASE_URL=postgresql://user:password@host/db
JWT_SECRET=your-secret-key
GEMINI_API_KEY=your-api-key

# .env.example (commit this: it shows what variables are needed)
DATABASE_URL=
JWT_SECRET=
GEMINI_API_KEY=
```

```js
// Access in Node.js
const dbUrl = process.env.DATABASE_URL

// Access in Next.js (must prefix with NEXT_PUBLIC_ for client)
const apiUrl = process.env.NEXT_PUBLIC_API_URL