logo

Where do credentials end and configuration begin in your env file?

Not every env variable belongs in phpunit.xml

Joel Clermont
Joel Clermont
2026-08-10

Have you ever fixed a failing test by adding a variable to phpunit.xml, without stopping to ask if that was really the right place for it?

In the latest episode of the No Compromises podcast, Aaron and I dig into a real pull request disagreement about where environment variables belong. We draw a distinction between credentials and workflow configuration, and that difference determines exactly what goes into phpunit.xml and what stays out.

We also get into why zeroing out API keys and hostnames in your test environment is not optional, and how a small oversight in one PR can quietly expose your tests to real third-party services.

  • 00:00 A real PR disagreement about phpunit.xml
  • 01:07 Credentials vs workflow config in your env file
  • 03:17 Why Aaron is glad his tests failed
  • 04:49 How to properly isolate third-party test keys
  • 07:25 Silly bit

Listen Now (9 min)

And after listening, don't forget to subscribe to the podcast, so you don't miss future episodes.

Here to help,

Joel

P.S. A test that fails for the right reason is a gift. If your test suite isn't giving you that kind of confidence yet, our testing course shows you how to get there.

Toss a coin in the jar if you found this helpful.
Want a tip like this in your inbox every weekday? Sign up below 👇🏼
email
No spam. Only real-world advice.