I'm using Truffle to develop an ERC721 smart contract.
Truffle expects HDWalletProvider to be installed so that Truffle can sign transactions for you, however this requires storing your mnemonic locally and importing it into Truffle's config file. Isn't that really insecure? I've seen approaches where it's kept in a .env file, however this still seems vulnerable.
What's considered best practice from a security P.O.V?
Would it be deploying via Remix and MetaMask, with MetaMask connected to a hardware wallet so that the wallet's mnemonic and private key are never stored?