SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

How to Handle Environment Variables Safely in Node.js Apps

0
·1 views

Environment variables are the standard method for keeping sensitive configuration like API keys and database URLs out of application source code. Developers should centralise env var access in a dedicated config module that validates required variables at startup and crashes immediately if any are missing. Tools like dotenv, envalid, and joi help load, type-check, and set defaults for these variables, reducing scattered process.env calls across a codebase. Secrets should never be hardcoded as fallback defaults, logged in full, or committed to version control — a .env.example file with placeholder values should be used instead. Separate credentials per environment, regular key rotation, and platform-native secret management tools further reduce the risk of accidental exposure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer Builds Privacy-First Android App to Auto-Silence Phones Without Cloud

A developer created Muffle, an Android app that automatically adjusts phone sound profiles based on scheduled routines and location, after being inspired by a disruptive ringtone during a mosque sermon. The app was deliberately built with a zero-cloud architecture, meaning all data and logic remain entirely on the user's device. It uses Android's AlarmManager, ForegroundService, and GeofencingClient alongside a local Room database to manage sound rules without any server dependency. Prayer time calculations are handled on-device via the Adhan library, avoiding the need for cloud functions or external APIs. A key technical hurdle was Android's Doze mode, which delayed alarm triggers and required additional engineering to ensure timely sound profile transitions.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Deleting an API Key From Your Profile Doesn't Kill It in Running Processes

A developer discovered that deleting three API keys from their shell profile and verifying the change with a clean-room shell test did not actually revoke access for already-running processes. A long-lived editor process that had launched days earlier had frozen the old environment variables at startup and continued injecting them into every child process it spawned, including a reconnected review tool that authenticated successfully with the supposedly deleted key. This exposed a critical distinction between editing a config file on disk and having that change take effect in live processes. The env -i verification command only tests newly spawned shells and cannot detect stale values held in memory by existing parent processes. The author concluded that confirming a config fix requires checking three separate things: the file on disk, the environment frozen in any long-lived parent process, and the inherited environment of each child process spawned from that parent.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

A 41-Second Timeout Gap Silenced an Automated Affiliate Article System for 3 Days

A developer built a fully automated system using shell scripts and Claude Code to publish three affiliate articles daily to Hatena Blog without human involvement. For three consecutive mornings, the system ran without errors but produced zero articles, logging 'published today: 0 / target: 3' each time. The root cause was a misconfigured timeout set at 300 seconds, while the actual article-generation process required 259 seconds — leaving only a 41-second margin that was consistently exceeded. Doubling the timeout to 600 seconds resolved the issue immediately, restoring the system to its full three-article daily output. The system is designed around idempotency, meaning each scheduled run checks how many articles have already been published and generates only the remaining shortfall, ensuring the daily target is always met across morning, midday, and evening batches.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Free Red-Team Loop Can Expose AI Agent Vulnerabilities Before Production Launch

Developers building tool-using AI agents are advised to run automated red-team tests before exposing those agents to external users. The core risk lies in prompt injection, where malicious instructions hidden inside documents or web pages can manipulate an agent into violating its operating rules, a threat highlighted in OWASP's guidance on LLM applications. A three-part automated loop — involving a target agent, an attacker model, and a judge — can generate dozens of adversarial inputs and log any policy violations to a JSONL file for later review. Unlike manual testing, which typically covers only a handful of attack phrases, an attacker model can systematically probe tool names, combine legitimate requests with hidden commands, and surface wording gaps in the system prompt. The approach requires no dedicated GPU or large budget, as free model endpoints and free server options can host the entire testing harness.

0 comments Read more at DEV Community