Document how we load environment variables from .env
There is a precedence of /etc/vulnerablecode/.env over the local .env
file in all cases
Reported-by: Hritik Vijay
@@ -36,3 +36,13 @@ Start this timer with::
systemctl --user daemon-reload
systemctl --user start vulnerablecode.timer
+
+
+Environment variables configuration
+--------------------------------------
+
+VulnerableCode loads environment variables from an `.env` file when provided.
+VulnerableCode first checks the file at `/etc/vulnerablecode/.env` and if not
+present, it will attempt to load a `.env` file from the checkout directory.
+
+The file at `/etc/vulnerablecode/.env` has precedence.
