// blog

Engineering, security, building in public

Stories, guides, and deep dives from the Envpilot team about environment variable management, secrets security, developer tooling, and building a startup in the open. 24 posts

// 24 posts

featuredAugust 19, 20268 min read

The Error Names the Process That Noticed, Not the One That Broke

Four bugs in one afternoon of debugging envpilot run, and every single error message pointed at innocent software. What we measured instead, and the NODE_OPTIONS trick that turned out to fix the whole class of problem.

Abdul Rafay

#engineering#cli

Read post

#engineering#security

The Project Disappeared in One Request. Its Data Did Not.

A project can own Vault secrets, files, documentation, access grants, integrations, and years of versions. PR #174 turns deletion into a durable staged workflow that revokes access immediately, removes external data first, and keeps Convex cost bounded.

Aug 13, 20265 min read

#engineering#architecture

We Removed a Network Hop From the Dashboard

Envpilot's dashboard used to send routine project, organization, member, and tag work through Next.js before it reached Convex. PR #173 removes that middle layer, tightens authorization, and makes the expensive cleanup paths explicitly bounded.

Aug 12, 20264 min read

#guides#mcp

Giving Claude Code Access to Secrets Without Giving It Your .env

AI coding agents read your project directory — including the .env you left there. Here's a safer pattern: scoped, read-only, audited secret access over MCP, and what an agent should never be able to do.

Jul 23, 20264 min read

#guides#migration

dotenv-vault Is Deprecated — Here's Your Migration Path

dotenv-vault and the .env.vault format are deprecated. What that means for your team, what the real alternatives are (including the official one), and how to migrate in ten minutes.

Jul 21, 20264 min read

#engineering#architecture

My Paywall Used to Live in the Browser Bundle

Envpilot's tier limits started as a TypeScript object gated by a NEXT_PUBLIC_ env var, moved to the server in PR #33, and became a database-backed feature registry one day later in PR #39 — this is what four months of running features-as-data actually cost.

Jul 19, 202612 min read

#engineering#api

I Wrote a Rule Against Duplicated Auth. Then I Found My Own Code Breaking It.

One function was supposed to authorize every machine that talks to Envpilot. Two of the three surfaces call it. The third one shipped first, and that turns out to be the whole story.

Jul 18, 202616 min read

#engineering#security

The Password Box That Guarded My Entire Backend

For four months a single shared string called ADMIN_SECRET guarded every admin function in Envpilot, including a public Convex query that would tell anyone whether their guess was correct. This is how I ripped it out and replaced it with real WorkOS identity in one 71-file PR.

Jul 18, 202612 min read

#engineering#architecture

I Shipped the Same Feature Twice in One Day, Then Spent a Week Killing One of Them

Two hashed machine credentials, merged the same day, doing the same job. This is the story of collapsing them into one table with a single optional field — and why deleting a database table takes two pull requests instead of one.

Jul 18, 202616 min read

#engineering#ci-cd

I Rebuilt My Entire CI Pipeline on CircleCI. Thirty-Two Hours Later I Deleted It.

GitHub Actions minutes ran out twelve days into the billing cycle, so I ported the whole pipeline to CircleCI — then open-sourced the repo, which made Actions minutes free, and moved everything back. The round trip cost six firefighting PRs and nearly seventeen hours of main deploying to nowhere.

Jul 18, 202615 min read

#engineering#performance

My Database Bill Was a Closed Drawer Nobody Was Looking At

Envpilot burned through the Convex free-tier Database I/O quota, so I went hunting. The worst offender wasn't a slow query — it was an invisible component subscribing to more than it drew. Here's every read I found and the index trick I somehow shipped three separate times.

Jul 18, 202615 min read

#engineering#security

Eighty Days to Delete the Auth I Wrote Myself

I built my own OAuth device flow. Math.random() session codes, an in-memory session store running on serverless, and a backend that took your identity as a function argument. This is the story of every way it broke and how I tore it out.

Jul 18, 202619 min read

#engineering#security

The .env File That Refused to Die

I built a VS Code extension that writes decrypted secrets onto your disk. Then I spent five PRs learning every way they get back out — including the time my cleanup code deleted files it never wrote, and the time my own file watcher put them right back.

Jul 18, 202615 min read

#engineering#testing

The Safety Net I Built and Cut Down the Same Day

I shipped a Playwright deploy gate on Envpilot at 14:43 UTC and disabled it at 22:45 the same day — after it blocked five deploy jobs twice, held a CLI release six hours, and failed for a reason that turned out to be the product working correctly.

Jul 18, 202612 min read

#engineering#architecture

I Built a Fourth Client Surface. The Docs Now Say There Are Five, and Mine Isn't One of Them.

On 2026-05-08 I opened a draft PR adding a React Native app to Envpilot — 22,941 lines, including a from-scratch auth system storing tokens in plaintext. Ten weeks later the platform collapsed every machine credential into one hashed key, published an architecture doc counting five surfaces, and the mobile branch was still sitting there, open, unmergeable by anything short of a rewrite.

Jul 18, 202612 min read

#engineering#architecture

Eleven Shims, One Number, and a Version Check That Never Once Worked

Deleting old code is the easy part. The hard part is the number that tells old clients to update — and mine had been silently failing since March.

Jul 17, 202615 min read

#engineering#architecture

I Rebuilt My Permission System Three Times to Add Two Checkboxes

Adding an editor and a viewer role to Envpilot turned into a 57-file sweep with a runtime landmine at every missed site. I closed that PR unmerged and rebuilt the whole thing so roles are rows in a table and capabilities are the only thing code still owns.

Jul 17, 202617 min read

#engineering#ci-cd

I Merged Six PRs Straight to Main and Never Found the Bug

CI kept refusing to publish my VS Code extension because a value 'was not in the VSIX'. It was in the VSIX. Six merges, one checksum that proved I was wrong, and an ending I did not earn.

Jul 17, 202613 min read

#announcement

Introducing the Envpilot Blog

Why we're starting a blog, what Envpilot does, and what we'll be writing about — engineering, security, and building in public.

Jul 16, 20261 min read

#engineering#architecture

I Shipped a Fix for an Error Message Production Never Sent

A bulk paste failed on every row with the words 'Server Error'. Five days earlier I had polished the copy for that exact error — copy that does not exist in production. Then I found out the rule underneath it made my own product illegal.

Jul 16, 202615 min read

#engineering#security

The Security TODO I Wrote, Then Shipped Around for 113 Days

I swapped Stripe for Polar.sh because Stripe does not work in my region, and in the process I find-and-replaced the wording of my own security TODO while leaving the bug in production. This is the story of that hole, the seven lifecycle bugs next to it, and the fix that finally checked the box.

Jul 10, 202611 min read

#engineering#security

My Delete Button Was a Liar, and So Was My Rollback

Envpilot's UI said secrets were deleted and versions were restored. Neither was true — deletion never touched WorkOS Vault, and rollback flipped a pointer at itself. Three PRs in eighty-seven minutes made both words mean something.

Jul 8, 202614 min read

#engineering#product

Born and Buried: The 3,500-Line Feature That Only Ever Had Two Commits

I shipped a full behavioral anomaly detection system into Envpilot in April 2026 and deleted every line of it in July. This is what git history says about why — an hourly nested table scan, a detection pass fired on every variable access and every security event, and a 20-minute window that gives the whole thing away.

Jul 2, 202612 min read

#engineering#seo

The Four Lines of Metadata That Deleted My Site From Google

Envpilot's auth middleware was 307-redirecting Googlebot off /faq and /feed.xml while a root-level canonical tag told Google every other page was a duplicate of the homepage — two unrelated bugs, one Search Console readout, fixed in PR #67 and finally killed structurally in PR #116.

Jun 12, 202611 min read