Devora Cloud · Blog
Environment variables without passwords in code
Devora Cloud · Reviewed on
DATABASE_URL, S3 and the site address arrive as variables. The AI sets them. You do not paste a password into the ZIP.
A password in the repository leaks through Git, the ZIP and the build log. On Devora the database and S3 connections are injected into the app.
If your AI publishes, it creates those variables. You only confirm the name when the system expects something other than the default.
What stays out of the ZIP
The .env file, the dc_live_ token and node_modules. The manual the AI reads already lists that exclusion. If any of that is in the package, revoke the token and generate another.
Where to look
In the project, the Variables tab shows the name. A sealed value is not shown open in the browser. To change it, edit there or ask the AI in a thread that still has a valid token.
Frequently asked questions
Can I create a variable by hand?
Yes. The variables screen accepts a name and a value. The AI is the shortcut, not the only door.