Chapter 11 — Config & Secrets

The why

A misconfigured app is a vulnerable app. The most common and most damaging config mistakes are: hardcoding secrets in source code, missing required env vars, and using production credentials in development.

The three tiers of config

const PAGE_SIZE = 50;  // hardcoded in code — this is fine

NODE_ENV=development
PORT=3002
PGHOST=localhost

JWT_SECRET → fetched at runtime from AWS Secrets Manager, never in .env files in prod
DB_PASSWORD → same

The .env file setup

Never commit .env to Git. Always commit .env.example.

# .env.example — COMMIT THIS (no real values)
NODE_ENV=development
PORT=3002
 
PGHOST=localhost
PGPORT=5432
PGUSER=youruser
PGPASSWORD=yourpassword
PGDATABASE=quickbite_dev
DB_SSL=false
 
JWT_SECRET=replace_this_with_minimum_32_character_random_string

# .gitignore — THESE MUST BE HERE
.env
.env.local
.env.production

Validate env vars on startup — not optionally

The app should refuse to start if any required variable is missing or the wrong type. Clear error at startup beats silent failure at runtime.

// src/config/env.validation.ts
import * as Joi from 'joi';
 
export const envSchema = Joi.object({
  NODE_ENV: Joi.string()
    .valid('development', 'staging', '

// app.module.ts
ConfigModule.forRoot({
  isGlobal: true,
  validationSchema: envSchema,
  validationOptions: {
    abortEarly: false,  // report ALL missing vars at once, not just the first one
  },
})

If JWT_SECRET is missing when the app starts, you'll see:

ValidationError: "JWT_SECRET" is required

Clear, immediate, and impossible to miss.

Reading config in your code

Never read environment variables directly with process.env. Always use ConfigService:

// ❌ Wrong — bypasses validation
const secret = process.env.JWT_SECRET;
 
// ✅ Correct — goes through ConfigModule
@Injectable()
export class AuthService {
  constructor(private configService: ConfigService) {}
 
  getSecret() {
    return

configService.get() is validated and typed. process.env.JWT_SECRET returns string | undefined — if it's undefined, your code may not fail until a user tries to log in.

The danger of silent fallbacks

// ❌ EXTREMELY DANGEROUS
const jwtSecret = process.env.JWT_SECRET || 'default-secret';
 
// If JWT_SECRET is missing, every JWT signed with 'default-secret' is valid.
// This is a known string. Anyone can forge tokens.

AWS Secrets Manager (production)

In production, sensitive secrets (DB password, JWT secret) are never stored in environment variable files. They're stored in AWS Secrets Manager and fetched at startup via IAM role.

The environment variable AWS_AUTO_SECRET_ENV_VARIABLES controls which secrets to fetch. The app fetches them during bootstrap and merges them into the process environment.

You never need to change this mechanism — it's already set up. But know it exists so you don't accidentally override production secrets by setting them in .env.

Rules — memorize these

One thing to remember