Using dotenv to load vars when dploying to now. But still keep it out of your repo.

start.js

// load as early as possible
if(process.env.NOW){
  require('dotenv').config({path:'./.envnow', silent:true});
}else{
  require('dotenv').config({silent:true});
}

// now you can deploy with:

//$cp .env .envnow && now  && rm -r .envnow

//this will copy current .env to .envnow, then deploy to now, then delete the .envnow file
//so it stays out of your repo.