Varlock
title: Varlock type: tool created: 2026-05-19 last_updated: 2026-05-19 related: ["Playradar", "radar/tools/Infisical"] sources: ["https://varlock.dev/"] radar_quadrant: Tools radar_ring: retired radar_position: center
A security-focused environment variable management system that uses declarative .env.schema files as a single source of truth. Designed for AI-safe configuration: schema files give AI assistants full config context without exposing secret values.
Traditional .env files store both structure and secrets in the same file. Varlock separates them: a .env.schema file declares variable names, types, documentation, and sensitivity markers; actual values live in separate, gitignored files or are pulled from secret providers at runtime.
Schema decorators:
| Decorator | Purpose |
|---|---|
@sensitive |
Marks a variable as a secret — redacted from logs and AI context |
@required |
Validation fails at startup if absent |
@type |
Generates TypeScript types from the schema |
@docs |
Inline documentation surfaced to AI agents and developers |
The schema file is safe to commit and share with AI assistants. An AI agent reading .env.schema understands the full configuration surface — variable names, types, purpose — without seeing any values. This prevents accidental secret leakage to external AI services while preserving configuration context for code generation and debugging.
Varlock replaces dotenv/config with varlock/auto-load. No other application code changes are required. The varlock run command injects validated variables into any process, supporting Python, Go, Node.js, and other runtimes.
Values are resolved in priority order: process environment variables, local git-ignored overrides, environment-specific files, schema defaults. Layers can compose values using function calls.
Pulls secrets at runtime from: 1Password, Infisical, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, Bitwarden, or any CLI tool via function call syntax.
- Built-in
varlock scanfor leak detection - Runtime redaction of sensitive values from logs and responses
- Git hook integration to catch leaks before commits
- Local override encryption
npx varlock init
brew install varlockVarlock is retired (superseded, center position) as of 2026-06-25. It was deprecated after a full migration to lpassrc (LastPass CLI). All secrets previously held in the 1Password Varlock vault were migrated to LastPass Secure Notes; the set -a; eval "$(lpass show --notes '<repo>/env')" injection pattern replaced varlock run. The schema-first approach and AI-safe configuration model remain interesting, but the 1Password desktop app dependency and op:// reference format proved unnecessary overhead for a solo-developer pipeline. lpassrc covers the same shell env injection use case without a schema file or external process dependency.
