Secure Configuration Files with AI Prompts

Audit my configuration files for security issues.

Find and review:

1. All config files (*.config.js, *.json, *.yaml, *.toml)
2. Any hardcoded secrets in configuration
3. Configuration that should vary by environment

For each config file:

1. Identify any sensitive values that should be env vars
2. Check if the file is in .gitignore (if it should be)
3. Suggest a separation between public config and secrets

Create:

1. A public config file (can be committed) with non-sensitive defaults
2. Environment variable references for all secrets
3. A config validation schema to catch missing values at startup
4. Documentation of required vs optional configuration

Secure my Next.js configuration files.

Review and fix:

1. next.config.js - ensure no secrets are exposed
2. Check for secrets in publicRuntimeConfig (exposed to client!)
3. Verify serverRuntimeConfig is used for server-only secrets
4. Audit any custom config files

Create:

1. A secure config/index.ts that loads env vars
2. Proper separation of client-safe vs server-only config
3. Validation that fails at build time if config is missing
4. TypeScript types for all configuration values

Make sure NEXT_PUBLIC_ vars don't contain anything secret.

Create a secure configuration system for my Node.js application.

Requirements:

1. Separate config from secrets completely
2. Use environment variables for all secrets
3. Allow config files for non-sensitive settings
4. Support different environments (dev, staging, prod)
5. Validate all config at startup

Structure:

• config/default.js (non-sensitive defaults, committed)
• config/env.js (environment overrides, committed)
• .env files (secrets, NOT committed)

The system should:

• Merge config files with env var overrides
• Type-check configuration values
• Fail fast with clear errors for missing required values
• Never log sensitive values

Create a configuration validation system using Zod (or similar).

For my project's configuration:

1. Define a schema for all config values
2. Include types (string, number, boolean, url, email)
3. Mark which values are required vs optional
4. Add default values where appropriate
5. Include custom validation (valid URLs, proper formats)

The validation should:

• Run at application startup
• Provide clear error messages for missing/invalid values
• Transform values where needed (string to number)
• Export typed configuration object

Example config structure:

• Database: URL, pool size, SSL mode
• Auth: JWT secret, session duration, OAuth credentials
• API: rate limits, timeouts, external service URLs
• Features: feature flags and toggles

Help me prevent configuration files from being exposed.

Check for:

1. Config files accessible via web (/.env, /config.json)
2. Source maps that might expose config
3. Error messages that leak configuration
4. API endpoints that return config values

Implement:

1. Proper .gitignore for all sensitive config
2. Server rules to block access to config files
3. Error handling that doesn't expose secrets
4. Audit logging for config access

For deployment platforms:

• Vercel: check vercel.json for exposed routes
• Netlify: review _redirects and _headers
• AWS: check S3 bucket policies