theozero

Joined 16 years ago

Karma

Submissions

Member since

Jan 20

Recent submissions

check out varlock.dev (free and open source) Adds validation and has plugins to pull from anywhere (1pass, aws, keepass, etc)

Comment · 1 month ago

Related for secret handling tools like secretspec and varlock (https://varlock.dev), there's no way to securely hand claude code sensitive env vars for use with MCP. While it will do env var replacement in your MCP config, there's not really an easy way to set those vars. If using the cli you can wrap the `claude` command (bit awkward), but when running the desktop app, there is nothing.

I opened an issue here - https://github.com/anthropics/claude-code/issues/88757 - please chime in!

Comment · 2 months ago

I won't disagree that it comes with security tradeoffs and depending on the situation it can definitely be a problem. But in many cases with how people deploy lots of software - most PaaS and things like lambdas / cloudflare workers, etc - it's absolutely fine. With varlock, we can even swap out the secret delivery mechanism at the end - but you still get a schema and familiar interface for how it all works.

Comment · 2 months ago

.env as we know is full of problems... BUT! check out varlock (https://varlock.dev) - it's free and open source, and we have really modernized and adapted the familiar syntax (a small DSL on top) to make it much better.

Has built-in validation, type-safety, composition via functions, loading with plugins, leak prevention, and much more.

Comment · 2 months ago

Try adding varlock on top. It fixes some of the rough edges of using 1pass for dev purposes. Lots of neat features. We are 1pass users ourselves so our 1P plugin is quite good.

Comment · 2 months ago

Varlock solves many of these problems, and a lot more. Including having a built in credential broker - and works everywhere. Missing some easier DX around things that are typically detected from global files, but working on it.

Comment · 2 months ago

https://varlock.dev (free, open source) can pull secrets from many places, and has a credential broker (proxy) to inject placeholders, then replace with real secrets at the network boundary. There are a few other tools like this, but ours seems to be the most flexible so far.

Comment · 2 months ago

Varlock sounds like what you might be looking for. Free, open source, and very flexible toolkit to use however you like.

Comment · 2 months ago

Varlock has bw plugin too - and similarly you can either wire up individual items or pull a whole env style blob from a single item if you prefer.

Comment · 2 months ago

FYI - You can pull a whole .env style blob from a single item using varlock. Never written to disk and supports caching behind Secure Enclave.

Comment · 3 months ago

Of course there's no single solution and a multi-layered defense is needed... But as the article mentions, a huge step is first getting credentials out of plaintext, and then out of the process entirely using a "credential broker" (proxy) pattern - that means injecting placeholders, and replacing them in a MITM proxy. It's important of course to isolate the agent from the broker via sandboxing.

Varlock (https://varlock.dev -- free, open source) is a complete config+secrets toolkit that helps manage secrets, pull them from various secure places, provides such a credential broker. There are a few others out there, but most require a specific vault tied to the broker, while ours is open source and uses plugins to pull secrets from wherever you want.

Many sandbox and other AI services are now building this as a feature into their platforms, but Varlock is meant to be a universal toolkit that you can apply anywhere, without being coupled to the platform's proprietary vault and solution.

Comment · 3 months ago

While there are absolutely a million of these env tools popping up which are total vibe-coded slop, secretspec is not one of them. It's from the creator of https://devenv.sh and has been around for a while.

Comment · 3 months ago

Over at varlock (https://varlock.dev -- also free, open source), we agree that .env as we know it is full of problems. But instead of abandoning it, we evolved it. We replace your .env.example with a .env.schema - using decorator style comments to add schema info, and functions to load and compose values.

A big difference between our tool and many other similar tools is that we combine the schema and value setting into one surface, with a way of merging many definitions together, much like cuelang - but in a way that feels more intuitive. It's extremely flexible, and can even do credential brokering for untrusted workloads.

I've been enjoying the secretspec content lately, and watching it evolve :)

Comment · 3 months ago

Looks great. The "credential broker" pattern (inject placeholders, replace in proxy) is something we just added to https://varlock.dev (totally free and open source).

Rather than using a dashboard, ours is configured within a .env.schema file, and rather than our own vault, we can pull secrets using our plugins (16 and counting) including Infisical, 1Password, Bitwarden, AWS, GCP, Azure, more. Also very useful for coding tasks in general, as we have integrations for most frameworks, and add built in validation, type safety, leak detection, etc.

Will definitely be keeping an eye on OneCLI to compare notes.

Comment · 5 months ago

Check out varlock - it’s a free and open source toolkit to help with this. It has built in validation, extra protection for your secrets, and uses plugins to pull sensitive data from most common sources. Also has built in local encryption with biometric unlock.