box.json and box.local.json

Every Box reads its settings in this order: built-in defaults, then box.json, then box.local.json. Objects merge, so a local file only needs the keys it overrides.

File	Committed	Holds
box.json	yes	team settings, brand, recipe ledger, feature settings
box.local.json	no	secrets, credentials, ports, machine-specific overrides

The Box writes box.local.json with owner-only permissions. Never put a secret in box.json, and there is no environment-variable configuration.