Bun loads .env, .env.local, and .env.{NODE_ENV} into process.env at startup with no dotenv import and no flag. Precedence runs from most specific to least, and real environment variables override file values.
The convenience becomes a problem in tests. bun test sets NODE_ENV to test, but a plain .env in the repository root is still loaded, so a developer's local database URL or API base can silently apply to the test process. Under Node the same file would have had no effect without an explicit loader, so a suite ported from Node can start passing or failing for reasons that are invisible in the code.
Keep credentials out of .env and in .env.local, which should be gitignored, and put test-specific values in .env.test. Print what actually loaded with bun -e "console.log(process.env.DATABASE_URL)" before debugging further, and note that .env.local is deliberately not loaded when NODE_ENV is test.