Handling configuration and secrets in a hobby project without enterprise-level tooling

I have a hobby app with an API key and a few environment-specific settings. Hardcoding them is clearly wrong, but adopting a giant secrets platform for a script only I run seems excessive. I'm considering a local `.env` file ignored by Git plus an example config showing required variables, with production values provided by the hosting environment. What beginner mistakes should I check before pushing the project to a public repository?