# dmno-dev/varlock

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/dmno-dev-varlock).**

_How this analysis was created: the description and tags below were written by an AI model that read this project's README and public documentation pages; stars, license and language come straight from the GitHub API. The model does not read the source code._

4,923 stars · 142 forks · TypeScript · MIT

## Links

- GitHub: https://github.com/dmno-dev/varlock
- Homepage: https://varlock.dev
- awesome-repositories: https://awesome-repositories.com/repository/dmno-dev-varlock.md

## Topics

`configuration` `dotenv` `env` `env-vars` `schema` `security` `validation`

## Description

Varlock is an environment variable toolkit built around a committed schema that lives in plain env files. Types, validation rules, descriptions and sensitivity flags are written as JSDoc-style decorator comments, and loaded values are checked and coerced against that schema before the application runs. It also generates TypeScript types from the schema, and it keeps secret values away from AI coding agents: agents can see variable names, types and rules, but not the values behind them.

What sets it apart is the combination of secret protection and backend integration. Sensitive values are scanned for in build output, source maps and server responses, and they are redacted from build and runtime logs. A plugin system resolves secrets at load time from password managers, cloud secret services, vaults and Kubernetes, including AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, Bitwarden, 1Password, Doppler, Infisical, KeePass and others. Each backend supports several authentication methods for local, server and pipeline use, such as OIDC federation, service accounts and device keys. Bulk loading, caching of fetched secrets and handling of missing values are also covered.

Integrations for Vite, Next.js, Nuxt and Cloudflare Workers replace default .env loading with schema-driven validation, inline public values at build time and keep sensitive ones out of shipped code. A standalone binary CLI runs commands with the resolved variables injected and does not need a separate language runtime. A minimal container image is provided for multi-architecture use. An editor extension adds syntax highlighting, autocomplete, hover details and inline validation for schema files, and an Effect integration generates typed config modules.

## Tags

### Software Engineering & Architecture

- [Environment Variable Validation](https://awesome-repositories.com/f/software-engineering-architecture/schema-based-state-validation/environment-variable-validation.md) — Defines types, rules and descriptions for environment variables in a committed schema, then validates loaded values and coerces them to the right types.
- [Comment-Based Schemas](https://awesome-repositories.com/f/software-engineering-architecture/comment-based-schemas.md) — Defines variable types, validation rules and sensitivity flags as JSDoc-style decorator comments inside plain env files, parsed into one schema.
- [Decorator-Based Validation](https://awesome-repositories.com/f/software-engineering-architecture/decorator-based-validation.md) — Attaches types, requirements and validation rules to variables via JSDoc-style decorator comments in env files, backed by a parser and open specification. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/env-spec-parser))
- [Type Generation](https://awesome-repositories.com/f/software-engineering-architecture/data-schema-validation/data-type-validation/collection-type-validation/type-generation.md) — Generates TypeScript types from the environment schema for autocomplete, type checking and inline documentation when reading variables.
- [Type-Safe Schema Validators](https://awesome-repositories.com/f/software-engineering-architecture/data-schema-validation/data-type-validation/type-safe-schema-validators.md) — Checks loaded variables against declared types and rules, converts them to expected types, and provides type safety before application code runs. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/env-spec-parser))
- [Next.js Integrations](https://awesome-repositories.com/f/software-engineering-architecture/integration-extensibility/framework-specific-integrations/next-js-integrations.md) — Replaces Next.js's built-in env-file loader with a small config plugin, adding schema validation and leak protection on Next.js 14+ with Webpack or Turbopack. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/integrations/nextjs))
- [Vite Integrations](https://awesome-repositories.com/f/software-engineering-architecture/integration-extensibility/framework-specific-integrations/vite-integrations.md) — Ships a Vite plugin that replaces default env file loading with schema-driven loading for plain Vite and framework-based projects. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/integrations/vite))
- [Plugin Architectures](https://awesome-repositories.com/f/software-engineering-architecture/plugin-architectures.md) — Adds new decorators, functions and data types through installable plugins, so each secret backend integrates without touching core code. ([source](https://github.com/dmno-dev/varlock/blob/main/README.md))

### Development Tools & Productivity

- [Env Schema Type Generators](https://awesome-repositories.com/f/development-tools-productivity/env-schema-type-generators.md) — Generates type definitions from the environment schema so application code reads variables with autocomplete, type checking and built-in documentation. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/integrations/nuxt))
- [Build-Time Variable Injection](https://awesome-repositories.com/f/development-tools-productivity/build-time-constants/build-time-variable-injection.md) — Replaces non-sensitive environment variable references with resolved literal values at build time, producing bundles with no runtime lookup. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/integrations/expo))
- [Dotenv Schema Language Tooling](https://awesome-repositories.com/f/development-tools-productivity/dotenv-schema-language-tooling.md) — Provides an editor extension and parser for decorator comments in env files with highlighting, autocomplete, hover details and inline validation.
- [Environment-Injected Command Runners](https://awesome-repositories.com/f/development-tools-productivity/environment-injected-command-runners.md) — Runs any command from the command line with validated, resolved environment variables injected so the program starts fully configured. ([source](https://github.com/dmno-dev/varlock#readme))
- [Standalone CLI Runtimes](https://awesome-repositories.com/f/development-tools-productivity/standalone-cli-runtimes.md) — Ships a self-contained binary CLI that validates the schema, resolves values and launches child processes with variables injected, needing no separate runtime.

### Security & Cryptography

- [AI Agent Secret Redaction](https://awesome-repositories.com/f/security-cryptography/ai-agent-secret-redaction.md) — Hides secret values from AI coding agents while exposing variable names, types and rules, and blocks sensitive values from leaking into logs, bundles and responses.
- [External Secret Resolution](https://awesome-repositories.com/f/security-cryptography/external-secret-resolution.md) — Resolves secret values at load time from password managers, cloud secret stores, and vaults through declarative references and plugins. ([source](https://github.com/dmno-dev/varlock/blob/main/README.md))
- [Plugin-Driven Secret Backends](https://awesome-repositories.com/f/security-cryptography/external-secret-resolution/plugin-driven-secret-backends.md) — Fetches secrets at load time through installable plugins that evaluate function-call syntax, letting each backend add its own decorators and functions.
- [Secret Leak Prevention](https://awesome-repositories.com/f/security-cryptography/secret-leak-prevention.md) — Varlock detects sensitive values in build output and runtime responses, blocks them from being exposed in client bundles or served code, and redacts them from build-time logs. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/integrations/astro))
- [Secret Management Integrations](https://awesome-repositories.com/f/security-cryptography/secret-management-integrations.md) — Pulls secrets at load time from password managers, cloud secret services, vaults and Kubernetes through plugins with multiple authentication methods.
- [Secret Vault Integrations](https://awesome-repositories.com/f/security-cryptography/security/cryptography-and-secrets/secrets-credential-management/secret-vault-integrations.md) — Offers a plugin system that fetches secrets at load time from password managers, cloud secret stores, vaults and Kubernetes.
- [Cloud Secret Managers](https://awesome-repositories.com/f/security-cryptography/cloud-secret-managers.md) — Retrieves secret values from cloud secret managers into config items at resolution time, using the item key as the default secret name. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/plugins/google-secret-manager))
- [Function-Call Value Resolution](https://awesome-repositories.com/f/security-cryptography/function-call-value-resolution.md) — Resolves unquoted function-call syntax in env values to decrypt data or fetch from external sources without application code. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/env-spec-parser))
- [Response Leak Blocking](https://awesome-repositories.com/f/security-cryptography/secret-leak-prevention/response-leak-blocking.md) — Varlock inspects outgoing responses and blocks sensitive environment values from being sent to clients by accident. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/integrations/cloudflare))
- [Sensitive Variable Redaction](https://awesome-repositories.com/f/security-cryptography/sensitive-variable-redaction.md) — Masks sensitive environment variable values in output printed during the build so secrets are not exposed in build logs. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/integrations/vite))
- [Client Bundle Exclusion](https://awesome-repositories.com/f/security-cryptography/sensitive-variable-redaction/client-bundle-exclusion.md) — Keeps sensitive variables out of inlined JavaScript, warns on client-side references at build time, and throws if native code reads them. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/integrations/expo))

### Web Development

- [Framework Environment Loader Integrations](https://awesome-repositories.com/f/web-development/framework-environment-loader-integrations.md) — Provides integrations for Vite, Next.js, Nuxt, Cloudflare Workers and containers that load and validate environment variables from one schema.
- [Nuxt Integrations](https://awesome-repositories.com/f/web-development/firebase-backend-integrations/nuxt-integrations.md) — Ships a Nuxt module hooking into Vite config and the server build so env files load and validate consistently across dev, build, and production. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/integrations/nuxt))
- [Environment Loading Plugins](https://awesome-repositories.com/f/web-development/syntax-transformers/bundler-transformer-plugins/environment-loading-plugins.md) — Wraps Vite, Next.js, Nuxt and Cloudflare tooling to load and validate variables before builds, inline public values and keep secrets out of output.

### Data & Databases

- [Declarative Environment Schemas](https://awesome-repositories.com/f/data-databases/data-processing-pipelines/data-serialization/json-schema/declarative-environment-schemas.md) — Describes each variable's name, type, rules and description in a single schema file that serves as the shared source of truth. ([source](https://github.com/dmno-dev/varlock/blob/main/README.md))

### DevOps & Infrastructure

- [Secret Leak Detection](https://awesome-repositories.com/f/devops-infrastructure/build-pipeline-scanning/secret-leak-detection.md) — Scans compiled bundles, source maps and server responses for known sensitive values, blocking or redacting matches before they can be published.
- [Environment File Loaders](https://awesome-repositories.com/f/devops-infrastructure/configuration-management/file-based-configuration/configuration-file-loading/environment-file-loaders.md) — Combines a committed schema file, per-environment value files, and shell variables in a fixed override order into one resolved configuration. ([source](https://github.com/dmno-dev/varlock/blob/main/packages/env-spec-parser))

### Programming Languages & Runtimes

- [Framework Package Integration](https://awesome-repositories.com/f/programming-languages-runtimes/package-installations/framework-package-integration.md) — Provides drop-in packages for common web frameworks and build tools so validated, protected environment variables work inside those projects. ([source](https://github.com/dmno-dev/varlock#readme))