dmno-dev/varlock

What it solves

It addresses the security risks of using environment variables in the AI era, specifically preventing AI agents from accessing sensitive secrets while still providing them with the necessary configuration context. It also solves the problem of keeping .env.example files in sync with actual environment variables by introducing a single source of truth via schemas.

How it works

Varlock uses a custom DSL called @env-spec to attach schemas, types, and validation rules to .env files using JSDoc-style comments. This allows agents to read the schema (variable names, types, and descriptions) without seeing the actual secret values. It includes a CLI for loading and validating variables, a scanning tool (varlock scan) to detect leaked secrets in AI-generated code, and a plugin system to securely pull secrets from backends like 1Password, AWS, and HashiCorp Vault.

Who it’s for

Developers building AI-powered applications or using AI agents to manage code, as well as teams needing a secure, type-safe way to manage environment variables across multiple environments.

Highlights

• AI-Safe Configuration: Provides agents with context without exposing secrets.
• Proactive Leak Prevention: Includes scanning tools and git hooks to catch secrets in code.
• Runtime Protection: Features log redaction and leak prevention.
• Extensible Secret Management: Plugin system for integrating with various secret managers (e.g., 1Password, Azure Key Vault, GCP).
• Type Safety: Offers validation, coercion, and IntelliSense support.