Encrypt .env.<env> with Laravel's env:encrypt, mint the decryption key with a CSPRNG, and install it on a deploy box over ssh — all from one artisan command, without the key ever touching stdout, shell history, or a process argument.