StackBlitz .env loads secrets in plain text; secure injection missing

Answer to the Open Questions

1. Planned secure secret‑injection? – As of the latest public releases and roadmap notes, StackBlitz does not offer a built‑in vault integration or encrypted secret injection. The public sandbox creation API currently stores the env payload in plain text.

2. External secret manager integration? – There is no native hook for services such as HashiCorp Vault or AWS Secrets Manager. You would need to build a small wrapper that fetches the secret at sandbox creation time and injects it via the API or CLI.

3. Recommended CI patterns? – Keep secrets out of the repository. Pass them as environment variables to the sandbox creation API or the StackBlitz CLI, or run tests outside the sandbox where the CI system can inject secrets directly.

Likely Explanation vs Confirmed Facts

• Likely explanation: StackBlitz automatically loads any .env file found at the repository root into process.env for both Node and browser sandboxes. If that file is committed, the secrets become visible to anyone with project access.
• Confirmed facts:
  • Public sandbox creation API accepts an env object that is stored unencrypted.
  • Runtime UI overrides are transient and are lost on reload, making them unsuitable for repeatable CI builds.
  • No documented vault integration or secret‑manager hook exists for secure injection.

Practical Steps for CI Pipelines

1. Keep .env out of source control. Use .env.example for developers and .env.local that is listed in .gitignore.
2. Pass secrets via the API or CLI.

   curl -X POST https://api.stackblitz.com/v1/sandboxes \
     -H "Content-Type: application/json" \
     -d '{\n    \"repo\": \"user/repo\",\n    \"env\": {\n      \"API_KEY\": \"$API_KEY\",\n      \"DB_PASS\": \"$DB_PASS\"\n    }\n  }'

   Replace $API_KEY and $DB_PASS with environment variables defined in your CI system.

3. Use the StackBlitz CLI for local CI runs.

   npx stackblitz create user/repo --env API_KEY=$API_KEY,DB_PASS=$DB_PASS
   # run your tests inside the created sandbox
   

4. Validate injection. Add a temporary console log in your app’s entry point that prints a masked value or a unique token to confirm the secret is present without exposing the full value.

When to Avoid In‑Sandbox Secrets

If your CI workflow only needs the secrets for database connections or API calls that can be performed outside the sandbox, keep the sandbox environment minimal and run integration tests in your CI runner instead. This eliminates the risk of accidental exposure entirely.

Next Diagnostic Question

Do you need the secrets to be injected into the sandbox for automated test runs, or are they only required for manual debugging within the editor? The answer will influence whether you should rely on API/CLI overrides or move the tests outside the sandbox.