Roadmap relationship
Outcome
Provide a consistent scoped configuration experience for plaintext variables and write-only secrets, including bulk dotenv workflows, inheritance/overrides, drift previews, provider secret backends, rotation metadata, and safe deployment injection.
Current gap
Environment variables live in several config shapes and commands, serverless secret operations target AWS backends, site env editing is dashboard-specific, and config:* secret/env commands contain placeholders. There is no shared scope model, masked diff, bulk editor, inheritance explanation, rotation workflow, or cross-interface parity.
User experience
- Use separate Variables and Secrets views with project/environment/service scope, inherited values, overrides, source backend, last updated/used metadata, and permission-aware masking.
- Support paste/upload
.env, multiline values, duplicate/conflict detection, search, bulk select, move/copy scope, and downloadable variable-only export. - Before save/deploy, show added/changed/removed key names and affected services; secret values remain masked and never appear in the diff.
- Reveal/copy secret only when backend permits, after recent auth and explicit audit; default workflow is replace/rotate, not reveal.
- Warn on reserved names, size/runtime limits, stale references, and missing required variables.
Scope
- Define scoped variable and secret-reference models with deterministic precedence across project, environment, service/function, and preview.
- Adapters for AWS Secrets Manager, SSM Parameter Store, encrypted local/box storage, and future provider stores.
- Implement list metadata, set/replace, delete, bulk import, variable export, reference validation, rotation metadata, and dependent-service redeploy planning.
- Resolve secrets at execution/deploy boundaries and inject using native provider references where possible.
- Expose shared CLI/API/dashboard schemas and migrate current config without uploading values unexpectedly.
Technical direction
- Persist only plaintext variables allowed by policy plus secret identifiers/version metadata; secret values stay in backend or encrypted envelope.
- Use write-only API fields and centralized redaction for errors, events, audit diffs, command output, and telemetry.
- Hash resolved configuration for drift/release provenance without making low-entropy values recoverable.
- Add optimistic concurrency and idempotent bulk mutations.
Safety and operability
- Prevent secret values from entering URLs, shell argv, generated public assets, search index, browser hydration, or downloadable exports.
- Production deletions/replacements show dependent services and require appropriate permission/confirmation.
- Preview environments inherit no production secrets by default.
- Audit actor/key/scope/action/backend/version but never value.
Acceptance criteria
- Users can import variables and secrets, understand precedence, preview key-level changes, deploy, and reproduce via CLI/API.
- A member without secret permission sees key presence only where policy allows and cannot infer values.
- Rotation creates a new backend version/reference and identifies/redeploys dependents safely.
- Existing server, serverless, and site environment paths converge on the same resolution rules.
Verification
- Precedence, parser/quoting/multiline, conflict, optimistic concurrency, backend adapter, and rotation tests.
- Browser payload, log, event, audit, search, export, argv, and error redaction tests.
- End-to-end bulk import → deploy → rotate → dependent redeploy flow.
Non-goals
- Turning the dashboard database into the primary secret vault.
- Exporting secret values in
.envdownloads by default. - Automatically rotating third-party credentials without a provider-specific rotator.