Environment variables should be stored in a secure manner, not hard-coded in the application code. Tools like dotenv can be used to load environment variables from a .env file during development. In production, environment variables should be set directly on the hosting platform, ensuring confidentiality and security.