985: Stop putting secrets in .env

Scott and Wes are joined by Phil Miller and Theo Ephraim to talk about Varlock, a new approach to environment variables that adds schemas, validation, and security to the humble .env file. They dig into the risks of traditional env workflows, how schema-driven configs improve DX, and how tools like Varlock help manage secrets safely across frameworks, CI, and AI-powered workflows.

Show Notes

•
00:00 Welcome to Syntax!

•
03:15 The Risks of .env Files

•
04:58 Introducing Varlock (varlock.dev): A Unified Solution

•
06:56 Schema-Driven Environment Variables

•
11:47 Integrating with Various Frameworks

•
14:08 Brought to you by Sentry.io (sentry.io/syntax)

•
14:32 Cross-Language Compatibility

•
17:50 Best Practices for Environment Variables

•
21:11 Security Features of Varlock

•
25:02 AI Integration and Environment Variables

•
29:12 Introduction to Varlock and GitHub Actions

•
32:45 Secrets Management and Best Practices

•
36:09 The Future of Varlock and Open Source

•
38:36 Sick Picks + Shameless Plugs

Sick Picks

• Phil: Bela.io (bela.io/products)

• Theo: Wonder Man (imdb.com/title/tt21066182)

Shameless Plugs

• Phil: nauticalartifacts.bandcamp.com

• Theo: howtostore.food

Hit us up on Socials!

Syntax: X (twitter.com/syntaxfm) Instagram (instagram.com/syntax_fm) Tiktok (tiktok.com/@syntaxfm) LinkedIn (linkedin.com/company/96077407/admin/feed/posts) Threads (threads.net/@syntax_fm)

Wes: X (twitter.com/wesbos) Instagram (instagram.com/wesbos) Tiktok (tiktok.com/@wesbos) LinkedIn (linkedin.com/in/wesbos) Threads (threads.net/@wesbos)

Scott: X (twitter.com/stolinski) Instagram (instagram.com/stolinski) Tiktok (tiktok.com/@stolinski) LinkedIn (linkedin.com/in/stolinski) Threads (threads.net/@stolinski)

Randy: X (twitter.com/randyrektor) Instagram (instagram.com/randyrektor) YouTube (youtube.com/@randyrektor) Threads (threads.net/@randyrektor)