theozero

6 ms·

1.
by theozero 14d ago
Related for secret handling tools like secretspec and varlock ( https://varlock.dev ), there's no way to securely hand claude code sensitive env vars for use with MCP. While it will do env var replacement in your MCP config,
2.
by theozero 19d ago
I won't disagree that it comes with security tradeoffs and depending on the situation it can definitely be a problem. But in many cases with how people deploy lots of software - most PaaS and things like lambdas / cloudflare worke
3.
by theozero 19d ago
.env as we know is full of problems... BUT! check out varlock ( https://varlock.dev ) - it's free and open source, and we have really modernized and adapted the familiar syntax (a small DSL on top) to make it much better. Has
4.
by theozero 1mo ago
Try adding varlock on top. It fixes some of the rough edges of using 1pass for dev purposes. Lots of neat features. We are 1pass users ourselves so our 1P plugin is quite good.
5.
by theozero 1mo ago
Varlock solves many of these problems, and a lot more. Including having a built in credential broker - and works everywhere. Missing some easier DX around things that are typically detected from global files, but working on it.
6.
by theozero 1mo ago
https://varlock.dev (free, open source) can pull secrets from many places, and has a credential broker (proxy) to inject placeholders, then replace with real secrets at the network boundary. There are a few other tools like this
7.
by theozero 1mo ago
Varlock sounds like what you might be looking for. Free, open source, and very flexible toolkit to use however you like.
8.
by theozero 1mo ago
Varlock has bw plugin too - and similarly you can either wire up individual items or pull a whole env style blob from a single item if you prefer.
9.
by theozero 1mo ago
FYI - You can pull a whole .env style blob from a single item using varlock. Never written to disk and supports caching behind Secure Enclave.
10.
by theozero 2mo ago
Of course there's no single solution and a multi-layered defense is needed... But as the article mentions, a huge step is first getting credentials out of plaintext, and then out of the process entirely using a "credential broker&
11.
by theozero 2mo ago
While there are absolutely a million of these env tools popping up which are total vibe-coded slop, secretspec is not one of them. It's from the creator of https://devenv.sh and has been around for a while.
12.
by theozero 2mo ago
Over at varlock ( https://varlock.dev -- also free, open source), we agree that .env as we know it is full of problems. But instead of abandoning it, we evolved it. We replace your .env.example with a .env.schema - using decorato
13.
by theozero 2mo ago
Looks great. The "credential broker" pattern (inject placeholders, replace in proxy) is something we just added to https://varlock.dev (totally free and open source). Rather than using a dashboard, ours is configured w
14.
by theozero 4mo ago
Check out varlock - it’s a free and open source toolkit to help with this. It has built in validation, extra protection for your secrets, and uses plugins to pull sensitive data from most common sources. Also has built in local encryption w
15.
by theozero 4mo ago
Get everything out of plaintext! Varlock is a great and flexible way to do this.
16.
by theozero 4mo ago
You might like varlock - it helps keep secrets out of plaintext by using plugins to pull from various backends (aws ssm, gcp, vault, 1pass, etc). Also has built in local encryption with shared team vaults coming soon. Additionally provides
17.
by theozero 4mo ago
We piggyback on .env files with a new DSL rather than introducing a new file. Using plugins that register new functions, you can fetch from many different backends (15 and growing). The main difference if I understand correctly is that the
18.
by theozero 4mo ago
Check out https://varlock.dev - it uses functions and a plugin system to pull from different backends. But also allows composing values together in whatever way you like, has built in validation, extra protection for secrets, an
19.
by theozero 5mo ago
check out https://bumpy.varlock.dev - still a bit of work to do to make other languages even easier, but it fixes a few things with changesets around custom publishing.
20.
Show HN: Bumpy – versioning/changelog tool, fixed 120 open changesets issues(github.com)
5 points by theozero 5mo ago|0 comments
21.
by theozero 5mo ago
Totally - the only completely safe way is to inject keys in a proxy and keep them out of the process. But getting them totally out of plaintext is a great first step, both to keep it from AI and malicious scripts that are looking for keys.
22.
by theozero 5mo ago
You will probably like varlock - it helps get your keys out of plaintext, while giving your agents a schema and additional tools so it can interact with env vars safely. The next step is injecting your keys via proxy, but just varlock is a
23.
by theozero 5mo ago
Another tool that helps here is https://varlock.dev (free + open source!) There are plugins for many different secret storage solutions, including infisical - as well as native local encryption (ie secure enclave on mac) that wi
24.
by theozero 6mo ago
Check out https://varlock.dev - it makes .env files useful and safer!
25.
by theozero 6mo ago
You might like https://varlock.dev (free and open source) - it has a plugin system so you can follow this pattern but pull from many different backends. Plus it provides a lot more... like being able to import shared config&#x2F
26.
by theozero 6mo ago
You'll probably like https://varlock.dev (free and open source) Im just about to roll out similar built in secure-enclave encryption with fingerprint unlocking. But integrated into a larger tool that does validation, type g
27.
by theozero 6mo ago
Check out https://varlock.dev for a modern take on .env that gets your secrets out of plaintext. Free and open source - works with tons of tools. Adds validation, type safety, lots of nice features.
28.
by theozero 7mo ago
Reading from 1Password definitely does add some overhead, but at least our integration fetches in bulk so should be ~2s total and not scale with number of secrets. For team members, they don't need any service accounts, so its just mak
29.
by theozero 7mo ago
While the 1Password model is not perfect, you can organize your vaults however makes sense for your project. You can do prod/staging/dev, or by projects, etc. Or you can use the new environments feature and create a separate &quot
30.
by theozero 7mo ago
You will probably really like https://varlock.dev It’s a whole toolkit for this - with built in validation, type safety, and extra protection for sensitive secrets.

More ›