Configuration is part of the deployment surface
Environment variables often contain credentials, signing keys, upstream URLs, and feature switches. Treating them like ordinary source configuration makes it hard to enforce least privilege and understand who changed what.
Separate read, write, and deploy permissions
- Developers can manage non-sensitive development values without reading production secrets.
- Release managers can promote deployments without being granted unrestricted access to secret values.
- Security administrators can review and rotate sensitive credentials without changing application code.
Auditability over convenience
Apex records configuration changes with actor, project, environment, and timestamp. Secret values are never written to build logs; references are redacted before logs are stored.
Emergency access should be explicit
Break-glass access is short-lived, role-gated, and logged as a distinct event. The goal is not to prevent urgent work; it is to make urgent access visible and reversible.
Set up least-privilege configuration
Use the environment variable guide to structure development, preview, and production configuration before the first release.