Emily Chen·
It caught a Stripe key committed in our staging env and gave me a startup schema to fail fast
Validate, normalize, and generate environment configurations across dev, staging, and production with secret management and drift detection.
Environment Configuration Validator
You are a DevOps engineer specializing in environment configuration management. Validate and optimize the following configuration setup.
**Current Environment Variables:**
```
{{current_env}}
```
**Application Requirements:**
{{app_requirements}}
**Environments:**
{{environments}}
**Secret Management Tool:**
{{secret_tool}}
**Configuration Drift Report:**
{{config_drift}}
Perform a comprehensive configuration audit:
1. **Validation Report**: Check all required variables are present in each environment
2. **Security Audit**: Identify secrets in plain text, hardcoded credentials, exposed tokens
3. **Environment Parity Analysis**: Find configuration drift between environments
4. **Missing Configuration**: List missing variables needed for production readiness
5. **Type Validation**: Verify values match expected types (boolean, number, URL, etc.)
6. **Secret Rotation Check**: Identify secrets that may need rotation
7. **Normalized Config**: Generate clean .env templates per environment
8. **Secret Management Plan**: Move secrets to {{secret_tool}} with injection scripts
9. **Config Schema**: Create a validation schema (JSON Schema, env-schema, etc.)
10. **Documentation**: Generate configuration documentation with descriptions and defaults
11. **Validation Script**: A script to validate environment config at startup
12. **Drift Detection**: Setup for automated config drift detection in CI
Output templates, scripts, and documentation ready to use.
Ergebnisse
Audited the env config across dev/staging/prod. Two real problems: a plaintext secret committed to the repo, and prod is missing a required variable that dev silently defaults.
**Findings:**
| Severity | Finding | Location |
|----------|---------|----------|
| Critical | `STRIPE_SECRET_KEY` hardcoded in `.env.staging` (committed) | rotate immediately |
| High | `SESSION_SECRET` missing in prod — app falls back to a dev default | prod env |
| Medium | `REDIS_URL` differs in format between staging (`rediss://`) and prod (`redis://`) | parity drift |
**Startup validation schema** — fail fast instead of booting with a bad config:
```typescript
import { z } from "zod";
const Env = z.object({
NODE_ENV: z.enum(["development", "staging", "production"]),
DATABASE_URL: z.string().url(),
REDIS_URL: z.string().url(),
SESSION_SECRET: z.string().min(32), // no weak/default secrets
STRIPE_SECRET_KEY: z.string().startsWith("sk_"),
});
export const env = Env.parse(process.env); // throws on missing/invalid
```
**Remediation:**
1. Rotate the exposed Stripe key, then `git rm --cached .env.staging` and add it to `.gitignore`.
2. Move all secrets into the secret manager; inject at deploy via the platform's env, never commit.
3. Add the schema above to the entrypoint so a missing `SESSION_SECRET` crashes the boot with a clear message rather than running insecurely.
**Drift detection:** a CI step that diffs the *keys* (not values) of each environment's schema and fails on mismatch keeps the three environments in lockstep.
Modell: Claude Sonnet 4
9 Likes2 SavesScore: 5