Varlock

Varlock is an open-source environment configuration and secrets-management layer designed to avoid exposing secrets to coding agents via plaintext. Instead of relying on informal .env.example conventions, Varlock introduces a committed .env.schema that describes variable names, types, validation rules and documentation. It separates the configuration contract from the actual values. Secrets are resolved and injected at runtime from external vaults such as 1Password, AWS Secrets Manager or Azure Key Vault. For workloads where an agent must call an authenticated service, Varlock also offers a credential proxy that provides a placeholder to the agent and substitutes the real value only at the network boundary. We've found this to be a useful pattern that replaces ad hoc helper scripts and extends secret injection across multiple environments without exposing credentials.