15 · ความปลอดภัยของสภาพแวดล้อม

# bin/rails credentials:edit --environment production
#   → config/credentials/production.yml.enc + config/credentials/production.key

Rails.application.credentials.stripe_secret_key!      # raises if blank: fail fast
Rails.application.credentials.fetch(:database)         # KeyError if missing
Rails.application.credentials.dig(:aws, :secret_access_key)

ENV.fetch("DATABASE_URL")                              # fetch, don't default
ENV["SECRET_KEY_BASE"] || "changeme"

// config.js: validate env at boot with zod (or envalid)
import { z } from "zod";
const env = z.object({
  DATABASE_URL: z.string().url(),
  SESSION_SECRET: z.string().min(32),
  STRIPE_SECRET_KEY: z.string().startsWith("sk_"),
}).parse(process.env);          // throws at startup if anything is missing or malformed
export default env;

// local dev only: load .env (git-ignored)
if (process.env.NODE_ENV !== "production") await import("dotenv/config");
// never: process.env.SESSION_SECRET || "changeme"

# settings.py: pydantic-settings validates and fails fast
from pydantic import Field, PostgresDsn
from pydantic_settings import BaseSettings, SettingsConfigDict

class Settings(BaseSettings):
    model_config = SettingsConfigDict(env_file=".env")   # .env is git-ignored
    database_url: PostgresDsn
    secret_key: str = Field(min_length=50)
    stripe_secret_key: str = Field(pattern=r"^sk_")

settings = Settings()          # raises ValidationError at startup if missing
# never: SECRET_KEY = os.environ.get("SECRET_KEY", "changeme")