data in .ENV on risk? Security best practices

I think the .ENV file is just for use on local development environment...
The settings for production would must be on the internal config files...

No, you should not set e.g., database passwords in the config files.
Because config files are a part of an app source code that is shared with developers.

So secrets for production should not set in config files, should be set in environment variable or some other places.

But you could set environment variables with apache/nginx config.
See https://codeigniter.com/user_guide/gener...tml#apache

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper