skills.rest
leonardoacosta
leonardoacostaCOMMUNITY
Explore all skills by this author →
GitHub

env-and-secrets

Enforces dotenvx and @t3-oss/env rules for T3 environment variables and secret-safe code.

Updated Aug 2, 2026
Search Tags:#secrets management#environment variables#t3#dotenvx#ci configuration#env validation#t3-oss-env
One-click install
npx skills add https://github.com/leonardoacosta/skills --skill env-and-secrets-leonardoacosta
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: env-and-secrets
Source: https://github.com/leonardoacosta/skills/tree/main/t3-stack-kit/skills/env-and-secrets
Command: npx skills add https://github.com/leonardoacosta/skills --skill env-and-secrets-leonardoacosta

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires dotenvx, @t3-oss/env-nextjs, @t3-oss/env-core.

What problem does it solve? T3 projects often leak secrets through inconsistent .env loading, unvalidated process.env reads, and accidental exposure of server values in client bundles, tests, logs, or CI output. This Skill defines a single, portable set of rules for managing environment variables and keeping secret material out of code and evidence. ## Core Features & Use Cases - Single loader boundary: Standardizes one package-owned dotenvx with-env command with --overload, --quiet, and -f flags, forbidding nested loaders or in-code dotenv.config() calls. - Schema-validated env access: Requires an env.ts schema using @t3-oss/env-nextjs or @t3-oss/env-core with explicit server/client/runtimeEnv declarations before any variable is read. - Secret hygiene enforcement: Keeps secrets out of source, fixtures, snapshots, logs, and client bundles, and defers encryption, vault, and credential questions to the dotenvx-secrets and secrets-handling skills. - Use Case: When adding a new DATABASE_URL to a T3 app, apply this Skill to wire the dotenvx loader, declare the variable in the server schema, sync .env.example, and supply safe CI values without exposing real credentials. ## Quick Start Apply the T3 environment and secrets rules to review my env.ts schema, dotenvx scripts, and .env.example for the new variable I am adding.

Frequently Asked Questions about env-and-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up dotenvx in a T3 monorepo package?▼

Define one package-owned script such as "with-env": "dotenvx run --overload --quiet -f ../../.env --" and have other scripts call it. The --overload flag makes the project file win over inherited shell values, and you must not nest loaders or call dotenv.config() in code.

How do I validate environment variables with @t3-oss/env?▼

Create an env.ts schema using @t3-oss/env-nextjs with explicit server, client, and runtimeEnv declarations, or @t3-oss/env-core for non-Next packages. Add every new variable to the schema before reading it; never use bare process.env reads outside the schema boundary.

Can I expose server secrets through NEXT_PUBLIC_ variables?▼

No. Client variables use the framework's public prefix and are deliberately non-secret. A server secret must never appear in the client schema, browser bundle, serialized API data, error messages, or client-side diagnostics.

Should I commit my .env file to the repository?▼

Commit an encrypted application .env only when the repository's encryption workflow is established. Keep .env.keys ignored and never place private keys in source control; keep .env.example synchronized with required schema keys.

How do I handle real credentials in integration tests?▼

Use synthetic values in tests by default. An integration test needing a real credential must follow the dotenvx-secrets and secrets-handling skills; do not invent your own shell, vault, or redaction flow.

When should I use dotenvx-secrets instead of this skill?▼

Use dotenvx-secrets for encryption, redaction limits, credential injection, and vault references, and secrets-handling for discovered credentials and safe reporting. This skill only owns the application-code boundary for loading and validating environment variables.

Related Skills

Explore More Software Engineering Skills→
salafidurussalafidurus
1

turborepo

Configure Turborepo task pipelines and caching in turbo.json.

Official
Advanced
PlazaCCPlazaCC
2

dotenvx

Encrypt .env files and inject decrypted variables into process.env at runtime.

Official
Intermediate
leonardoacostaleonardoacosta

dotenvx-secrets

Inject, encrypt, and redact .env secrets with dotenvx when running coding agents.

Community
Advanced
Xipher-LabsXipher-Labs
6

secrets-yubikey-unlock

Store Infisical Machine Identity credentials in OS credential stores and load secrets into the shell.

Official
Intermediate