I don't know why people doesn't use the dart-define parameter to pass sensitive data like during build/run. You can even configure VSCode to read your .env file for some tasks/launch and avoid you to add this file as assets