Config Secrets Environments

Config Secrets Environments

Purpose

Use this skill when behavior depends on configuration or secrets. The goal is explicit config ownership, validation, and environment parity without exposing credentials.

Inventory

Collect:

1. Config files and env var declarations.
2. Runtime readers and startup wiring.
3. Secret sources: env, secret manager, local keychain, BYOK storage.
4. Environment matrix: local, test, dev, staging, prod.
5. Rotation, revocation, and audit requirements.
6. Existing .env.example, schema, docs, and CI checks.

Never print real secrets. Redact values and report only names, source type, and wiring status.

Design Rules

• Define a schema for required and optional config.
• Fail closed for missing critical config; do not silently fall back to insecure or broad behavior.
• Keep defaults safe for local development and explicit for production.
• Separate build-time and runtime config.
• Keep tenant/user-provided keys isolated from platform keys.
• Document rotation and revocation paths.
• Verify config is wired into startup, not only declared.

Environment Matrix

Use this shape:

Mark unknown values as unknown. Do not infer a production value from local files.

Output Shape

config_inventory:
environment_matrix:
secret_flows:
validation_and_startup_wiring:
drift_checks:
rotation_plan:
failure_behavior:
verification_commands: