fix: ignore all .env files for create-next-app by default (#61920)

We've seen too many instances of folks accidentally committing their
`.env` files that I feel it's time to make this change.

Up until now, Next.js has recommended that you use `.env.local` when
working locally to store your environment variables. Some developers do
intentionally want to commit their `.env` file without secret values to
source control. However, the ecosystem is fragmented on `.local`
support.

There are tools which require secrets values that do _not_ support
`.local` and require using `.env`. This means that it's possible to dump
your secret values into a `.env` file and commit to source control,
thinking that the defaults would have you covered.

This change updates the defaults for `create-next-app` to ignore all
`.env` files by default. If you want to commit then, you opt-in by
modifying your `.gitignore`, versus the opposite.

Related: https://x.com/complexlity/status/1755890800527892716

---------

Co-authored-by: Sam Ko <sam@vercel.com>

docs/02-app/01-building-your-application/07-configuring/03-environment-variables.mdx

@@ -14,14 +14,14 @@ description: Learn to add and access environment variables in your Next.js appli
 
 Next.js comes with built-in support for environment variables, which allows you to do the following:
 
-- [Use `.env.local` to load environment variables](#loading-environment-variables)
+- [Use `.env` to load environment variables](#loading-environment-variables)
 - [Bundle environment variables for the browser by prefixing with `NEXT_PUBLIC_`](#bundling-environment-variables-for-the-browser)
 
 ## Loading Environment Variables
 
-Next.js has built-in support for loading environment variables from `.env.local` into `process.env`.
+Next.js has built-in support for loading environment variables from `.env*` files into `process.env`.
 
-```txt filename=".env.local"
+```txt filename=".env"
 DB_HOST=localhost
 DB_USER=myuser
 DB_PASS=mypassword
@@ -51,7 +51,7 @@ export async function getStaticProps() {
 > **Note**: Next.js also supports multiline variables inside of your `.env*` files:
 >
 > ```bash
-> # .env.local
+> # .env
 >
 > # you can write with line breaks
 > PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
@@ -211,13 +211,11 @@ export default function Component() {
 
 ## Default Environment Variables
 
-In general only one `.env.local` file is needed. However, sometimes you might want to add some defaults for the `development` (`next dev`) or `production` (`next start`) environment.
+Typically, only `.env*` file is needed. However, sometimes you might want to add some defaults for the `development` (`next dev`) or `production` (`next start`) environment.
 
 Next.js allows you to set defaults in `.env` (all environments), `.env.development` (development environment), and `.env.production` (production environment).
 
-`.env.local` always overrides the defaults set.
-
-> **Good to know**: `.env`, `.env.development`, and `.env.production` files should be included in your repository as they define defaults. **`.env*.local` should be added to `.gitignore`**, as those files are intended to be ignored. `.env.local` is where secrets can be stored.
+> **Good to know**: `.env`, `.env.development`, and `.env.production` files should be included in your repository as they define defaults. All `.env` files are excluded in `.gitignore` by default, allowing you to opt-into committing these values to your repository.
 
 ## Environment Variables on Vercel
 
@@ -228,7 +226,7 @@ All types of Environment Variables should be configured there. Even Environment
 If you've configured [Development Environment Variables](https://vercel.com/docs/concepts/projects/environment-variables#development-environment-variables?utm_source=next-site&utm_medium=docs&utm_campaign=next-website) you can pull them into a `.env.local` for usage on your local machine using the following command:
 
 ```bash filename="Terminal"
-vercel env pull .env.local
+vercel env pull
 ```
 
 > **Good to know**: When deploying your Next.js application to [Vercel](https://vercel.com), your environment variables in `.env*` files will not be made available to Edge Runtime, unless their name are prefixed with `NEXT_PUBLIC_`. We strongly recommend managing your environment variables in [Project Settings](https://vercel.com/docs/projects/environment-variables?utm_medium=docs&utm_source=next-site&utm_campaign=next-website) instead, from where all environment variables are available.

packages/create-next-app/templates/app-tw/js/gitignore

@@ -25,8 +25,8 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# local env files
-.env*.local
+# env files (can opt-in for commiting if needed)
+.env*
 
 # vercel
 .vercel

packages/create-next-app/templates/app-tw/ts/gitignore

@@ -25,8 +25,8 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# local env files
-.env*.local
+# env files (can opt-in for commiting if needed)
+.env*
 
 # vercel
 .vercel

packages/create-next-app/templates/app/js/gitignore

@@ -25,8 +25,8 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# local env files
-.env*.local
+# env files (can opt-in for commiting if needed)
+.env*
 
 # vercel
 .vercel

packages/create-next-app/templates/app/ts/gitignore

@@ -25,8 +25,8 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# local env files
-.env*.local
+# env files (can opt-in for commiting if needed)
+.env*
 
 # vercel
 .vercel

packages/create-next-app/templates/default-tw/js/gitignore

@@ -25,8 +25,8 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# local env files
-.env*.local
+# env files (can opt-in for commiting if needed)
+.env*
 
 # vercel
 .vercel

packages/create-next-app/templates/default-tw/ts/gitignore

@@ -25,8 +25,8 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# local env files
-.env*.local
+# env files (can opt-in for commiting if needed)
+.env*
 
 # vercel
 .vercel

packages/create-next-app/templates/default/js/gitignore

@@ -25,8 +25,8 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# local env files
-.env*.local
+# env files (can opt-in for commiting if needed)
+.env*
 
 # vercel
 .vercel

packages/create-next-app/templates/default/ts/gitignore

@@ -25,8 +25,8 @@ npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 
-# local env files
-.env*.local
+# env files (can opt-in for commiting if needed)
+.env*
 
 # vercel
 .vercel