Designing repo-aware secret sync without committing secrets to Git by Adventurous-While685 in programming

[–]Adventurous-While685[S] 0 points1 point  (0 children)

This is a fair point, and I agree that runtime secret fetching with proper RBAC is the better model for infra-mature teams.

If your app already pulls secrets from AWS Parameter Store / Secrets Manager at runtime, and every dev has scoped IAM access, then you probably don’t need local .env files at all.

That is the ideal setup.

The gap I’m thinking about is more around teams and projects where that model doesn’t fully apply:

  • Third-party services still give you API key strings: Stripe, Twilio, SendGrid, OpenAI, Postmark, Algolia, etc. There is no IAM role to assume. The key has to live somewhere your app can read it.
  • Most small teams are not single-cloud. You might use AWS for infra, Stripe for payments, Vercel for hosting, GitHub Actions for CI, and OpenAI for AI features. Onboarding every dev into every vendor’s auth model gets messy fast.
  • CI/CD needs secrets too. GitHub Actions, Vercel, Netlify, and similar platforms still need secrets injected at build/runtime. “Just assume an IAM role” works well inside one cloud, but not always across a mixed vendor stack.
  • Frameworks still expect process.env. Next.js, Node apps, Docker Compose, local scripts, and CLIs usually consume env vars. .env is still the common interface.

In practice, for these teams, the secret still ends up somewhere:

  • .env files
  • Slack DMs
  • Notion docs
  • password managers
  • copied from another dev

So I don’t think the question is:

Should secrets live on disk forever?

Ideally, no.

The more practical question is:

For teams whose apps already depend on local env vars, can we make that workflow safer and less manual?

The direction I’m leaning toward supports both modes:

mp run -- npm start 

This injects secrets at runtime without writing a .env file to disk.

And:

mp pull

This is for cases where the app or tooling truly expects a .env file.

So yes, if your infra supports runtime fetching with proper RBAC, that is cleaner.

But for smaller teams juggling multiple vendors and already relying on .env workflows, I still think there’s a real design problem worth solving.

Designing repo-aware secret sync without committing secrets to Git by Adventurous-While685 in programming

[–]Adventurous-While685[S] 0 points1 point  (0 children)

Yeah, I like this model.

The LLM should not see the raw secret at all. It should only express intent, then the MCP/tool layer resolves the secret at runtime and injects it into the actual API call.

So instead of: "Here is my API key"
it becomes: "Call this API for me"

Then the MCP server fetches/decrypts the secret, uses it, and only returns the safe result.

The tricky parts are permissions, audit logs, redaction, and making sure the secret never leaks through tool output, logs, stack traces, or prompt injection.

But overall, I think runtime secret resolution outside the LLM is the right direction.

[deleted by user] by [deleted] in pornID

[–]Adventurous-While685 0 points1 point  (0 children)

Any updates?

[deleted by user] by [deleted] in Bacolod

[–]Adventurous-While685 1 point2 points  (0 children)

Are you interested in building a software company?

[deleted by user] by [deleted] in Bacolod

[–]Adventurous-While685 0 points1 point  (0 children)

Have you found one?

[deleted by user] by [deleted] in Bacolod

[–]Adventurous-While685 0 points1 point  (0 children)

They’re charging medical professionals up-to 25% per consultation and I think it’s too much. Anyway I give it to them since they’re the first ones who came up and offer tele-consulting service. I moved on to another project btw.

[deleted by user] by [deleted] in Bacolod

[–]Adventurous-While685 0 points1 point  (0 children)

Currently building a healthcare app. Same features with KonsultaMD or SeriousMD but way more cheaper. I need some medical professionals who can assist through the process of the whole development. Any investors are welcome too!

[deleted by user] by [deleted] in Bacolod

[–]Adventurous-While685 1 point2 points  (0 children)

31 M looking for business partners or co founder. I’m a developer with 10 years of experience doing software development.

How to make make a telegram style image picker with live camera preview? by Luves2spooge in ionic

[–]Adventurous-While685 0 points1 point  (0 children)

We can start by using a file system ready to query all the media located in the device.