One way of doing it, yes. Why would your dev repo have any credentials in .env?