Environment variables: separate configuration and secrets

Configuration changes by environment. Secrets are sensitive configuration that also need controlled storage, access and rotation. Neither belongs as a literal in source code.

Check a configuration record

The engineering foundations lab uses placeholder references.

from engineering_cases import environment_case

result = environment_case()
assert result["missing_required"] == []
assert result["source_contains_secret"] is False
assert result["secret_value_embedded"] is False
assert result["config"]["DATABASE_URL"] == "vault-reference:db/test"

Load and validate required values at startup, including type, allowed environment and safe ranges. Store real secrets in an environment/platform secret manager and inject them narrowly. An .env.example documents names with dummy values; real .env files stay ignored.

Do not print the full environment, connection URL or token in errors. Rotate exposed credentials and scan history, images and artifacts. Environment variables can still leak through process/debug tooling, so deployment permissions matter.

The FDE for Freshers course applies configuration discipline from CLI to Docker and cloud.

Exercise

Create a typed settings loader with required, optional and secret fields. Test missing and malformed values and prove seeded secrets never reach logs.

Continue learning

This article is part of the FDE engineering foundations sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Linux permissions for a deployed application.
• Continue with HTTP status codes in a client-facing service.

Reference: Twelve-Factor App configuration.