Validate and Mask Environment Variables in Node.js and TypeScript

Configuring environment variables seems simple, but it frequently leads to two common issues in production-grade applications:

1. Missing Variables: A developer adds a new variable locally but forgets to update the .env.example file. Other team members pull the changes, and their local environments crash.
2. Leaked Credentials: A debug log like console.log(process.env) prints database connection strings or API tokens to the terminal, leaving them visible in plaintext logs.

To solve this, we created @novaedgedigitallabs/envkit. It is a zero-dependency (other than Zod) utility that validates, loads, and masks environment variables, and keeps your example configurations updated automatically.

Key Features

• Schema Validation: Define your environment variables with Zod to enforce types and formats.
• Log Masking: Automatically redact sensitive credentials in console output.
• Example Syncing: Automatically append missing variables to your .env.example file without overwriting comments or values.
• Module Support: Runs in ESM and CommonJS.

Getting Started

Install the package and Zod:

npm install @novaedgedigitallabs/envkit zod

Enter fullscreen mode Exit fullscreen mode

Initialize your configuration in a file like env.ts:

import { createEnv } from '@novaedgedigitallabs/envkit';
import { z } from 'zod';

export const env = createEnv({
  schema: {
    DATABASE_URL: z.string().url(),
    JWT_SECRET: z.string().min(32),
    PORT: z.coerce.number().default(3000),
    NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
  },
  secrets: ['JWT_SECRET', 'DATABASE_URL'],
  generateExample: true, // Appends new keys to .env.example at runtime
});

Enter fullscreen mode Exit fullscreen mode

Because the variables are validated using Zod, your editor will provide full TypeScript autocomplete and type safety:

env.PORT;         // Resolved as a number
env.JWT_SECRET;   // Resolved as a string

Enter fullscreen mode Exit fullscreen mode

Preventing Secret Leaks in Logs

Logging environment configs is a common debugging habit. With envkit, any variables listed in the secrets array are automatically masked when printed:

console.log(env);
// Output:
// { 
//   PORT: 3000, 
//   NODE_ENV: 'development', 
//   JWT_SECRET: '[MASKED]', 
//   DATABASE_URL: '[MASKED]' 
// }

Enter fullscreen mode Exit fullscreen mode

The underlying code still accesses the correct, unmasked values when called directly (e.g., env.JWT_SECRET), keeping your database connections and authentications functional while protecting your log files.

Keeping .env.example Files Synchronized

Updating example files manually is tedious. Envkit offers two ways to sync them:

1. Runtime Syncing

By setting generateExample: true in createEnv, the library reads your schema during startup and appends any missing keys directly to .env.example.

2. CLI Tool

If you prefer to sync before running your code, you can use the CLI tool:

npx envkit generate

Enter fullscreen mode Exit fullscreen mode

This parses your .env file and appends only the new, missing keys to .env.example. Unlike standard tools that overwrite the entire target file, this command is non-destructive: it preserves all your existing values, custom comments, and spacing.

If you use non-standard file names, you can specify them manually:

npx envkit generate --env .env.production --out .env.production.example

Enter fullscreen mode Exit fullscreen mode

Comparison with Existing Tools

Feature dotenv t3-env envkit Loads env files Yes Yes Yes Zod validation No Yes Yes Framework agnostic Yes Limited Yes Secrets masking in logs No No Yes Auto .env.example sync No No Yes ESM + CommonJS support Yes ESM only Yes

Support

If envkit saved you time → novaedgedigitallabs.tech/pay

Conclusion

Validating your environment configurations and keeping your example files updated should not require manual tracking. By integrating validation, log masking, and automated syncing, @novaedgedigitallabs/envkit ensures your environment is consistent and secure.

If you want to view the source code, report issues, or contribute, you can find the project on GitHub: github.com/novaedgedigitallabs/envkit.