Guided Notes

Configuration & Environment Variables

Keeping secrets out of code, process.env, .env files, validating configuration at startup, environment-specific settings, and the twelve-factor approach.

Why environment variables

Slide 1 / 5

Configuration differs between your laptop, staging and production: database URLs, API keys, ports, feature flags. Hard-coding them is dangerous: • secrets end up in Git history (and public repos get scanned by attackers within minutes), • changing a setting requires a code change and redeploy.

The twelve-factor app approach: store config in the environment. Node reads it from process.env.