feat: encrypt injected env blob for secure serverless deployments by theoephraim · Pull Request #656 · dmno-dev/varlock

theoephraim · 2026-04-24T21:50:13Z

Summary

Adds support for encrypting the resolved env blob that varlock injects into server-side build output. This protects secrets from leaking via sourcemaps or build artifact inspection on serverless platforms (Vercel, Netlify, Cloudflare Workers, etc.).

Encryption across all integrations

When _VARLOCK_ENV_KEY is set (or @encryptInjectedEnv decorator is enabled), the env blob is encrypted with AES-256-GCM before injection. At runtime, server-only init code decrypts it before initVarlockEnv() runs.

Vite / Astro / SvelteKit / TanStack Start — encrypted blob set on globalThis.__varlockEncryptedEnv, decrypted in virtual init module
Next.js — encrypted payload in process.env.__VARLOCK_ENV, decrypted by init-server/init-edge bundles
Cloudflare Workers — encrypted blob uploaded as CF secret, decrypted in worker init
Expo — no encryption needed (same-process)
auto-load — encrypts process.env.__VARLOCK_ENV in-place, sets parsed object on globalThis

Architecture

Decryption removed from env.ts entirely — no node:crypto dependency in client-bundleable code
New globalThis.__varlockEncryptedEnv separates encrypted blobs from parsed objects on __varlockLoadedEnv
crypto.ts uses top-level import instead of broken require in ESM output

New root decorators

@encryptInjectedEnv — declares encryption intent, supports forEnv(). Auto-generates key for dev servers and Cloudflare deploys, errors on production builds without key
@disableProcessEnvInjection — prevents injecting individual vars into process.env, forcing ENV proxy usage. Combined with encryption = zero plaintext secrets in process.env

CLI changes

varlock generate-key — fixed for ESM builds
varlock run --inject <all|vars|blob> — controls what gets injected into child process env (replaces deprecated --no-inject-graph)

Docs

New "Encrypted deployments" guide with platform-specific setup (Vercel, Netlify, Cloudflare)
Root decorator reference for both new decorators
Integration pages updated with concise notes linking to guide

Test plan

varlock generate-key works
Auto-load path encrypts/decrypts correctly
Auto-generates key when decorator set but no key provided
Vite SSR build with @encryptInjectedEnv produces encrypted output
Next.js build with _VARLOCK_ENV_KEY produces encrypted runtime files
Cloudflare varlock-wrangler deploy auto-generates key
@disableProcessEnvInjection prevents individual var injection
varlock run --inject blob only injects blob
Framework tests pass

bumpy-bot · 2026-04-24T21:50:53Z

The changes in this PR will be included in the next version bump.

Minor releases

varlock 1.4.0 → 1.5.0

Patch releases

@varlock/astro-integration 1.0.3 → 1.0.4 (cascade)
@varlock/cloudflare-integration 1.1.4 → 1.1.5
@varlock/expo-integration 1.1.0 → 1.1.1
@varlock/nextjs-integration 1.1.2 → 1.1.3
@varlock/vite-integration 1.1.2 → 1.1.3

Bump files in this PR

encrypted-env-blob.md (view diff) (edit)

Click here if you want to add another bump file to this PR

This comment is maintained by bumpy.

pkg-pr-new · 2026-04-24T21:52:28Z

Open in StackBlitz

varlock

npm i https://pkg.pr.new/varlock@656

@varlock/cloudflare-integration

npm i https://pkg.pr.new/@varlock/cloudflare-integration@656

@varlock/expo-integration

npm i https://pkg.pr.new/@varlock/expo-integration@656

@varlock/nextjs-integration

npm i https://pkg.pr.new/@varlock/nextjs-integration@656

@varlock/vite-integration

npm i https://pkg.pr.new/@varlock/vite-integration@656

commit: 14bbc4d

cloudflare-workers-and-pages · 2026-04-25T08:35:37Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	`14bbc4d`	Commit Preview URL Branch Preview URL	Jun 01 2026, 09:38 PM

When _VARLOCK_ENV_KEY (64-char hex) is set at build time, the resolved env blob injected into build output is encrypted with AES-256-GCM. At runtime, the init bundles detect the varlock:v1: prefix and decrypt using the same key from the runtime environment. This lets Vercel users set a single env var and have all other config travel encrypted inside the deployment artifact. - New crypto module with sync (node:crypto) and async (Web Crypto) paths - All integration injection points (Next.js, Vite) encrypt when key is present - _VARLOCK_ENV_KEY auto-excluded from injected blob and type generation - varlock generate-key CLI command with --plain flag for piping - Docs for Next.js and Vite integrations - Framework tests for encrypted blob flow

The test was looking for `.next/server/**/*runtime*.js` which doesn't match webpack output files. Changed to `.next/server/**/*.js` and removed the prerendered HTML assertion since the page is dynamic.

philmillman

added a few nits. One thing we may want to consider for the future is whether we allow an arbitrary key name and then do the logic based on a type instead? Also does it make sense to allow them to generate/BYOK?

tsup/esbuild strips the node: prefix from imports, so varlock's built dist uses `import crypto from 'crypto'` instead of 'node:crypto'. Vite SSR only auto-externalizes node:-prefixed imports, so it tries to bundle bare 'crypto' and fails with "Dynamic require not supported". Fix: explicitly add 'crypto' to ssr.external in the Vite plugin config.

esbuild strips the node: prefix from imports, so varlock's built dist uses bare 'crypto' which Vite SSR doesn't auto-externalize. Add it to ssr.external in the Vite plugin config.

esbuild strips the node: prefix from imports, so varlock's built dist uses bare 'crypto' which Vite SSR doesn't auto-externalize. Add it to ssr.external in the Vite plugin, but skip when CF Vite plugin is present since Workers handle node builtins via nodejs_compat.

socket-security · 2026-06-01T21:24:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/ansis@4.3.1
	npm/tsdown@0.22.1
	npm/semver@7.8.1

View full report

- Use dynamic encryption keys in framework tests instead of hardcoded - Improve docs wording for encrypted env blob notes

github-actions Bot added maintainer core:varlock integration:nextjs integration:vite labels Apr 24, 2026

theoephraim changed the title ~~feat: encrypt env blob with VARLOCK_ENV_KEY~~ feat: encrypt env blob with _VARLOCK_ENV_KEY Apr 25, 2026

theoephraim force-pushed the feat/encrypted-env-blob branch from d467143 to 93ac514 Compare April 25, 2026 08:35

github-actions Bot added the core:website label Apr 25, 2026

theoephraim force-pushed the feat/encrypted-env-blob branch from 93ac514 to 5978976 Compare May 30, 2026 05:40

theoephraim changed the title ~~feat: encrypt env blob with _VARLOCK_ENV_KEY~~ feat: encrypted deployments with @encryptInjectedEnv + @disableProcessEnvInjection May 30, 2026

chore: update bump file for cloudflare and expo integrations

4f5b773

theoephraim changed the title ~~feat: encrypted deployments with @encryptInjectedEnv + @disableProcessEnvInjection~~ feat: encrypt injected env blob for secure serverless deployments May 30, 2026

theoephraim requested a review from philmillman May 30, 2026 05:54

theoephraim added 2 commits May 29, 2026 23:21

fix: use correct glob pattern for nextjs encrypted blob test

71dc215

The test was looking for `.next/server/**/*runtime*.js` which doesn't match webpack output files. Changed to `.next/server/**/*.js` and removed the prerendered HTML assertion since the page is dynamic.

test: add expectSuccess to vite encrypted blob test for debugging

ef80c32

RobAndrewHurst mentioned this pull request Jun 1, 2026

Add Varlock environment validation 🧙 GEOLYTIX/xyz#2822

Draft

philmillman approved these changes Jun 1, 2026

View reviewed changes

theoephraim added 3 commits June 1, 2026 13:27

fix: externalize bare crypto for Vite SSR builds

19c80ac

esbuild strips the node: prefix from imports, so varlock's built dist uses bare 'crypto' which Vite SSR doesn't auto-externalize. Add it to ssr.external in the Vite plugin config.

chore: address PR review comments

14bbc4d

- Use dynamic encryption keys in framework tests instead of hardcoded - Improve docs wording for encrypted env blob notes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: encrypt injected env blob for secure serverless deployments#656

feat: encrypt injected env blob for secure serverless deployments#656
theoephraim wants to merge 8 commits into
mainfrom
feat/encrypted-env-blob

theoephraim commented Apr 24, 2026 •

edited

Loading

Uh oh!

bumpy-bot commented Apr 24, 2026 •

edited by github-actions Bot

Loading

Uh oh!

pkg-pr-new Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 25, 2026 •

edited

Loading

Uh oh!

philmillman left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

theoephraim commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Encryption across all integrations

Architecture

New root decorators

CLI changes

Docs

Test plan

Uh oh!

bumpy-bot commented Apr 24, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Minor releases

Patch releases

Bump files in this PR

Uh oh!

pkg-pr-new Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

philmillman left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

theoephraim commented Apr 24, 2026 •

edited

Loading

bumpy-bot commented Apr 24, 2026 •

edited by github-actions Bot

Loading

pkg-pr-new Bot commented Apr 24, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Apr 25, 2026 •

edited

Loading

socket-security Bot commented Jun 1, 2026 •

edited

Loading