Values are encrypted (DOTENV_PUBLIC_KEY* is the only plaintext); the private keys stay in .env.keys, which is gitignored. Run the app with 'dotenvx run -f .env -- node tools/server.js' locally.
