.env.development.local for development tokens/secrets, and .env.production.local for production ones. They're not pushed because .gitignore: https://github.com/sapphiredev/gemboard/blob/main/.gitignore#L24-L27dotenv wouldn't load further than just .env) is because the project uses @skyra/env-utilities (dependencies in package.json), which loads them, more information on the package's README.