Environment variables are documented in .env.example

Without .env.example, every new developer must read source code to discover which environment variables the project requires — and they will invariably miss some. The result is a broken local setup, a support request to the original author, or — worse — a developer who hard-codes credentials to get unstuck. ISO 25010 maintainability.analysability fails at the setup boundary. SSDF PW.4 requires documenting configuration requirements; an absent .env.example is a direct gap. Projects with Supabase, Stripe, and auth libraries typically have 8–15 required variables.

Create .env.example in the project root with every variable the project uses, substituting real values with descriptive placeholders:

# Authentication
NEXTAUTH_SECRET=generate-with-openssl-rand-base64-32
NEXTAUTH_URL=http://localhost:3000

# Database
DATABASE_URL=postgresql://user:password@localhost:5432/myapp

# Stripe
STRIPE_SECRET_KEY=sk_test_...
STRIPE_WEBHOOK_SECRET=whsec_...
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...

Commit .env.example to git. Keep .env.local gitignored. Reference .env.example in README.md setup instructions (see the readme-exists check).