Environment variables and secrets are a traditional organizational security weak point—API keys and credentials end up committed in plaintext .env files, pasted into chat, and copied between machines. We use 1Password as the secure vault for those secrets, with access governed per-vault and per-team rather than by passing raw values around.
1Password integrates directly with Varlock through the @varlock/1password-plugin: secrets are declared in .env.schema as op:// references and resolved at load time—pulled from a 1Password vault using a service account in CI/CD and production, or desktop-app biometric auth in local development—so plaintext secrets never live in the repository or on developer machines.
How We Use It
- Storing API keys and credentials in vaults instead of plaintext .env files
- Resolving secrets into Varlock via op:// references (service accounts in CI/CD, biometric auth locally)
- Team secret sharing with per-vault access control and rotation
Auth & Security
Why this matters: Security is trust—modern auth and session practices protect users and keep compliance teams comfortable. Security is foundational. We standardize on modern auth, strong session management, and defense-in-depth controls to protect users and systems. Preferred defaults: BetterAuth for app auth, token-based sessions with rotation, 2FA (TOTP + WebAuthn), Arcjet for edge protection.