Merge pull request #733 from othercorey/4.x-env-files

4.x - Updated comment on using .env files

config/bootstrap.php

@@ -46,14 +46,19 @@
 use Cake\Utility\Security;
 
 /*
+ * See https://github.com/josegonzalez/php-dotenv for API details.
+ *
  * Uncomment block of code below if you want to use `.env` file during development.
  * You should copy `config/.env.example to `config/.env` and set/modify the
  * variables as required.
  *
- * It is HIGHLY discouraged to use a .env file in production, due to security risks
- * and decreased performance on each request. The purpose of the .env file is to emulate
- * the presence of the environment variables like they would be present in production.
- */
+ * The purpose of the .env file is to emulate the presence of the environment
+ * variables like they would be present in production.
+ *
+ * If you use .env files, be careful to not commit them to source control to avoid
+ * security risks. See https://github.com/josegonzalez/php-dotenv#general-security-information
+ * for more information for recommended practices.
+*/
 // if (!env('APP_NAME') && file_exists(CONFIG . '.env')) {
 //     $dotenv = new \josegonzalez\Dotenv\Loader([CONFIG . '.env']);
 //     $dotenv->parse()