One rule
Do not bake secrets into your image. Pass them at runtime through Compose, and commit only safe example values.
A Dockerfile ENV value stays in the image and can be viewed later. Use it only for harmless defaults, not passwords, API keys, JWT secrets, or database URLs.
Two env files
You usually need two files. One real file for your laptop, and one example file for the repo.
The real file is named .env and should be ignored by Git. The example file can be named .env.example and should be committed.