Production: security, testing and deployment · Lesson 15 of 18
Configuration and environment secrets
Separate configuration from code, validate it at startup, and keep secrets out of logs.
The same code should run in development, staging and production; configuration changes: port, database URL and API keys. Keep it in the environment or a secret manager, not source. Parse and validate once at startup, then pass a typed object through the application.
Secret manager / env
Startup validation
Typed config
Application services
function loadConfig(env) {
const port = Number(env.PORT || 3000)
if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error("PORT must be valid")
if (!env.APP_MODE) throw new Error("APP_MODE is required")
return { port, mode: env.APP_MODE }
}
console.log(loadConfig({ PORT: "8080", APP_MODE: "test" }))Use defaults only for non-sensitive values. A missing secret should stop startup with the variable name but never its value. .env is for local development and belongs in .gitignore; production secrets come from encrypted platform settings or a vault with rotation and least privilege.
Quick question
A production API key is missing. What should happen?
Exercise
Write parseBool(value) accepting only true and 1 as true, then print true false false.
Expected output: true false false
function parseBool(value) {
}
console.log(parseBool("true"), parseBool("false"), parseBool(undefined))Learn more from
Played 0 of 2 games
Sign in to save your progress and earn XP.