Varlock - AI-safe .env files

 ██▒   █▓ ▄▄▄       ██▀███   ██▓     ▒█████   ▄████▄   ██ ▄█▀
 ▓██░   █▒▒████▄    ▓██ ▒ ██▒▓██▒    ▒██▒  ██▒▒██▀ ▀█   ██▄█▒ 
  ▓██  █▒░▒██  ▀█▄  ▓██ ░▄█ ▒▒██░    ▒██░  ██▒▒██    ▄ ▓███▄░ 
   ▒██ █░░░██▄▄▄▄██ ▒██▀▀█▄  ▒██░    ▒██   ██░▒██▄ ▄██▒▓██ █▄ 
    ▒▀█░   ▓█   ▓██▒░██▓ ▒██▒░██████▒░ █████▒░▒ ████▀ ░▒██▒ █▄
    ░ ▐░   ▒▒   ▓▒█░░ ▒▓ ░▒▓░░ ▒░▓  ░░ ▒░▒░▒░ ░ ░▒ ▒  ░▒ ▒▒ ▓▒
    ░ ░░    ▒   ▒▒ ░  ░▒ ░ ▒░░ ░ ▒  ░  ░ ▒ ▒░   ░  ▒   ░ ░▒ ▒░
      ░░    ░   ▒     ░░   ░   ░ ░   ░ ░ ░ ▒  ░        ░ ░░ ░ 
       ░        ░  ░   ░         ░  ░    ░ ░  ░ ░      ░  ░

AI-safe .env files:
Schemas for agents, secrets for humans

# Declarative schema — AI agents get full context, never secret values
# @sensitive @required @type=string(startsWith=sk-ant-api)
# @docs(https://platform.claude.com/docs/en/api/overview)
ANTHROPIC_API_KEY=

# @type=enum(development, preview, production, test)
APP_ENV=development # set non-sensitive default values directly

# use function calls and plugins to securely fetch data from external sources
XYZ_TOKEN=op("op://api-prod/xyz/auth-token")

Unlike .env.example, your .env.schema is a single source of truth, built for collaboration, that will never be out of sync. Agents can read your schema for full context — without accessing your secrets.

# built-in encryption for local overrides - NOTHING in plaintext
ANTHROPIC_API_KEY=varlock(local:ABC123...)

Get Started Reference Docs

Featured in Ep 985 GitHub Secure Open Source Fund

Expo & React Native CLI

AI-Safe Config

Your .env.schema is readable by AI agents — they get full context on your config without ever seeing secret values. Prevent leaks to AI servers by design.

Leak Scanning

Proactively scan your codebase for leaked secrets with varlock scan. Set up git hooks to catch leaks before they're committed.

Runtime Protection

Redact sensitive values from logs and console output. Detect leaks in bundled client code and outgoing server responses at runtime.

Validation

Powerful validation capabilities, without custom logic. Misconfiguration errors are surfaced much earlier in your development cycle, with clear error messages.

Type-safety

Automatically generate types according to your schema - the single source of truth - instead of writing them by hand.

Environments

Combine defaults, environment-specific .env files, local git-ignored overrides, and process env vars. Compose values together using functions.

Secure secrets

Load secrets from 6 provider plugins — 1Password, Infisical, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, and Bitwarden — or any CLI tool.

Get Started Reference Docs

Installation

# Install as a dependency in a js project
npx varlock init

# OR install as standalone binary via homebrew
brew install dmno-dev/tap/varlock
# OR via cURL
curl -sSfL https://varlock.dev/install.sh | sh -s

Drop-in replacement for dotenv

 import 'dotenv/config';
 import 'varlock/auto-load';

// *optional* type-safe env access
 import { ENV } from 'varlock/env';
 const client = new AbcApi(process.env.ABC_API_KEY);
 const client = new AbcApi(ENV.ABC_API_KEY);

varlock can be used as a direct replacement for dotenv in most projects. Just swap your import and get validation, security, and more. No other code changes required!

Run anywhere - with any language

varlock run -- python my_script.py

Use varlock run to inject resolved, validated env vars into another process.

Credential broker for AI agents

Run coding agents, MCP servers, and any untrusted tool so they only ever see placeholder secrets. The real values are injected at the network boundary against a cryptographically verified upstream, and scrubbed back out of responses, so a prompt-injected or compromised agent has nothing to leak. You run the broker yourself, on the same host as the agent, so the real secrets never go to a third party.

# @sensitive @proxy(domain="api.stripe.com")
STRIPE_SECRET_KEY=yourPreferredPlugin()

varlock proxy run -- claude

Placeholder isolation: the agent never holds a real secret, even if it re-runs varlock load or reads its own environment.
Verified-identity injection: secrets are sent only to upstreams whose TLS identity checks out against public CAs, never over cleartext.
Scrub and audit: real values are scrubbed back out of responses, and every request is logged with no secret values.

Read the credential proxy guide