[docs] Warn/clarify that env vars are NOT "SECRET"

[JBallin]

Fixes#5676

[JBallin]

Lines 26-30 (in my branch, pasted below) need to be adjusted as well, but I would like some clarity. I'm uncertain why there are such deliberate assertions that secrets can be used in env vars, am I misunderstanding something? I would also like some insight into when not to include env vars in version control.

These environment variables can be useful for displaying information conditionally based on where the project is deployed or consuming sensitive data that lives outside of version control.

First, you need to have environment variables defined. For example, let’s say you wanted to consume a secret defined in the environment inside a <form>:

[petetnt]

First, you need to have environment variables defined. For example, let’s say you wanted to consume a secret defined in the environment inside a

:

I think the secret there can be safely changed to "variable" there.

[petetnt]

Few tiny comments, all in all I think this is a pretty good change and something that seems to trip many new CRA users (including people in my team).

[JBallin]

Thanks for the review @petetnt, incorporated your suggestions. Still unsure about this line:

These environment variables can be useful for displaying information conditionally based on where the project is deployed or consuming sensitive data that lives outside of version control.

[petetnt]

I think that the whole sentence could be removed, it doesn't offer much / anything that wasn't explained in the document beforehand.

[JBallin]

I think that the whole sentence could be removed, it doesn't offer much / anything that wasn't explained in the document beforehand.

@petetnt I actually like the first part of the sentence (up until "deployed"), but I'm still curious as to why version control was brought up.

These environment variables can be useful for displaying information conditionally based on where the project is deployed or consuming sensitive data that lives outside of version control.

[stale]

This pull request has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

[JBallin]

I’m still waiting for a response from the maintainers, so this should be kept open.

[ianschmitz]

Thanks for this @JBallin. Just one small tweak and I think we should be good.

[ianschmitz]

Thanks @JBallin!

[JBallin]

Thank YOU @ianschmitz, I'm so excited to have made my first contribution to CRA!

Unfortunately, an unintended change snuck through. I've opened a PR (#6386) to fix it. Sorry about that.