direnv actually won't run anything until you explicitly allow it to. And if the .env file changes, you have to re-allow direnv to read and execute it.

Seems safe to me