We use Varlock to manage environment variables from a single committed schema (.env.schema) with decorators for required, typed, and sensitive values—replacing framework-native env access with one consistent, validated source of truth.
Varlock validates configuration at build and runtime, generates TypeScript types, and keeps secrets explicitly marked and out of logs—giving us uniform, safe config handling across projects regardless of host or framework.
For sensitive values it integrates with 1Password through the @varlock/1password-plugin, resolving op:// secret references at load time so credentials stay in a vault rather than in plaintext .env files.
How We Use It
- Schema-validated, typed environment configuration across environments
- Explicitly marking and protecting sensitive secrets
- Catching missing or misconfigured env vars before deploy
Auth & Security
Why this matters: Security is trust—modern auth and session practices protect users and keep compliance teams comfortable. Security is foundational. We standardize on modern auth, strong session management, and defense-in-depth controls to protect users and systems. Preferred defaults: BetterAuth for app auth, token-based sessions with rotation, 2FA (TOTP + WebAuthn), Arcjet for edge protection.