.env is another "simple" format that turns out to be actually a whole family of languages where each handles corner cases differently. And usually implementations quietly do nonsense on malformed input. Some even have command injection vulnerabilities. Or at least this was the case back when I looked at a few such implementations and wrote up this: https://github.com/panzi/punktum