What is Environment variable?
A setting stored outside your code, like a secret key. Your laptop and your live site each have their own copy.
Where Environment variable goes wrong in real apps
Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.
The life of a click · 4 minutes · Pro
Works on my machine
Sign-up works perfectly on your laptop. On the live site, every sign-up fails.
Read the fixWhy does it work locally but not in production?
The most common cause is a missing environment variable. Your .env file exists only on your laptop; production has its own settings. Add the variable in your hosting dashboard, redeploy, and validate required variables at startup so a missing one fails the deploy instead of your users.
Data you can lose · 5 minutes · Free
The agent that reset production
You asked your coding agent to fix a failing migration. It says it 'reset the database to resolve drift'. Your live customers are gone.
Walk it, freeHow do I stop an AI agent deleting my database?
Do not keep production database credentials where the agent runs. Use a separate development database locally, give production a role that cannot drop tables, and keep backups the agent cannot reach. Instructions like 'never touch production' are not enough; only permissions reliably stop a destructive command.
The life of a click · 4 minutes · Pro
Confirm email, reach localhost
Your first real user signs up and clicks the confirmation link. Their browser says 'This site can't be reached: localhost'.
Read the fixWhy does my email link go to localhost?
Your auth provider's Site URL or redirect setting still points at your development address, so production users are sent to localhost, which only exists on your computer. Set the Site URL to your real domain and add each environment's exact callback URL to the allowed redirect list.
AI inside your app · 4 minutes · Pro
The chatbot that shared its instructions
A user posted a screenshot of your support bot's hidden instructions, including the staff-only discount code and an API key.
Read the fixCan users see my chatbot's system prompt?
Assume yes. A system prompt is text in the same conversation as the user's messages, and models can be talked into repeating it. The prompt text itself is rarely the danger; secrets and rules inside it are. Keep API keys in server environment variables and enforce permissions in code, so a leaked prompt reveals nothing useful.
Related terms
- Secret key
- A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
- Production
- The real, live version of your app that customers use, as opposed to the copy on your laptop.
- API
- The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
- Authorization
- Checking what someone is allowed to do once you know who they are. Signed in does not mean allowed.
- Server
- A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
- Browser
- Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.