From the 12-factors, III Config:
A litmus test for whether an app has all config correctly factored out of the code is whether the codebase could be made open source at any moment, without compromising any credentials.
but then...
Another approach to config is the use of config files which are not checked into revision control, such as config/database.yml in Rails. This is a huge improvement over using constants which are checked into the code repo, but still has weaknesses: it’s easy to mistakenly check in a config file to the repo; there is a tendency for config files to be scattered about in different places and different formats, making it hard to see and manage all the config in one place.
Our system is a bunch of microservices. Each microservice is an "app", per 12-factor. I like the idea of being in the mindset that we could decide on a whim to open source one of them and we should be able to do so because it keeps us accountable; codecov, being responsible about secrets in code and being as frictionless as one can be when onboarding newcomers..
But an open-source component should be easy to run and demo. How can Jack from the other side of the world, run and demo our open source component he just cloned, if i don't check at least an .env that describes required ports etc?
I find READMEs of the type:
"Wait.. wait.. before you run this, do X on port Y...oh and also this, and also that".
to be in bad taste.
PS: This question is similar but not a dupe. The OP could use something like Vault and get it over with; that's not an option here.