Varlock is an AI-safe environment variable management toolkit that helps developers manage, validate, and secure their configuration. Designed by DMNO Inc., it provides a declarative schema-based approach to handling secrets, ensuring that AI agents can access full configuration context without being exposed to actual secret values. Varlock serves as a modern replacement for traditional dotenv tools, offering enhanced security and type safety while remaining language and framework agnostic.

The tool functions by utilizing a declarative .env.schema file that acts as a single source of truth for all application configuration. Developers can use decorators to define types, sensitivity, and validation rules, which the Varlock CLI uses to validate environments, generate type definitions, and protect against leaks. It works as both a dependency for JavaScript/TypeScript projects and a standalone binary for other languages, ensuring consistent configuration across build and runtime environments.

Some of the key features are:

• AI-Safe Config: Allows AI agents to read schema context without accessing actual secret values, preventing unintended leaks to AI services.
• Leak Scanning: Proactively scans codebases for leaked secrets using custom git hooks and the varlock scan command.
• Runtime Protection: Automatically redacts sensitive values from console logs and system output, with detection for leaks in bundled client code.
• Validation & Type-Safety: Provides robust validation of environment variables and generates type definitions for improved developer experience.
• Secure Secrets: Supports local encryption with hardware-backed security, plus integration with major secret providers like 1Password, AWS Secrets Manager, and HashiCorp Vault.
• Multi-Environment Management: Enables flexible composition of configuration using defaults, environment-specific files, and local overrides.
• Framework Integrations: Offers built-in support for Next.js, Vite, Astro, and other popular frameworks, while supporting any language via varlock run.

Varlock is used by initializing a project with varlock init, which creates a schema file. Once configured, developers can use varlock load for validation or varlock run to inject validated variables into any process. The toolkit includes sophisticated redaction engines that operate on both CLI output and runtime server responses, ensuring secrets remain protected throughout the entire development lifecycle.

Some common use cases include:

• Pre-commit Secret Scanning: Running scans as git hooks to prevent developers from committing plaintext API keys to source code repositories.
• AI Agent Security: Providing secure access to configuration context for coding agents like Aider or Claude Code without exposing real credentials.
• Cross-Platform Secret Injection: Using a single source of truth for secrets across different infrastructure providers like AWS, Azure, and Google Cloud.
• Zero-Trust Deployment: Redacting sensitive values in CI/CD pipeline logs to prevent accidental exposure during build and deployment processes.