# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install security and environment libraries
pip install python-dotenv boto3 pydantic pydantic-settings cryptography

# Initialize project
npm init -y

# Install security and environment libraries
npm install dotenv zod @aws-sdk/client-sts dotenv-safe
npm install --save-dev typescript ts-node @types/node

import os
from typing import Optional
from pydantic import SecretStr, Field, ValidationError
from pyd_settings import BaseSettings # Standard pattern for modern Python apps

class AppConfig(BaseSettings):
    """
    Strictly typed configuration schema.
    Uses SecretStr to prevent accidental logging of credentials.
    """
    AWS_ACCESS_KEY_ID: str = Field(..., min_length=20)
    AWS_SECRET_ACCESS_KEY: SecretStr  # Prevents accidental print() leaks
    DATABASE_URL: str
    ENVIRONMENT: str = "development"

    class Config:
        env_file = ".env"
        extra = "forbid"  # Reject extra environment variables (prevents injection)

def load_secure_config() -> AppConfig:
    """
    Loads and validates configuration. 
    If an attacker injects a malicious variable via an AI-generated script,
    this will raise a ValidationError.
    """
    try:
        config = AppConfig()
        print("✅ Configuration validated successfully.")
        return config
    except ValidationError as e:
        print(f"❌ SECURITY ALERT: Invalid or malicious environment detected: {e}")
        raise SystemExit(1)

if __name__  == "__main "__:
    # Simulate loading
    config = load_secure_config()
    
    # Accessing the secret safely
    # print(config.AWS_SECRET_ACCESS_KEY) <--- This would show '**********'
    print(f"Running in: {config.ENVIRONMENT}")
    print(f"Key loaded: {config.AWS_ACCESS_key_id[:4]}...") 

import 'dotenv/config';
import { z } from 'zod';

// Define a strict schema for our environment variables
const envSchema = z.object({
  AWS_ACCESS_KEY_ID: z.string().min(20),
  AWS_SECRET_ACCESS_KEY: z.string().min(32),
  NODE_ENV: z.enum(['development', 'test', 'production']).default('development'),
  PORT: z.string().transform(Number).default('3000'),
});

// Type inference from the schema
type Env = z.infer<typeof envSchema>;

/**
 * Validates process.env against the schema.
 * This prevents "Shadow Variables" injected by malicious repository scripts.
 */
function validateEnv(): Env {
  const result = envSchema.safeParse(process.env);

  if (!result.success) {
    console.error("❌ CRITICAL: Environment validation failed!");
    console.error(result.error.format());
    // In production, we want the process to crash immediately if config is untrusted
    process.exit(1);
  }

  console.log("✅ Environment validated successfully.");
  return result.data;
}

// Usage
const env = validateEnv();

export const config = env;

// Example usage in an AWS SDK call
console.log(`Starting server on port: ${config.PORT}`);

AWS_ACCESS_KEY_ID=AKIAXXXXXXXXXXXXXXXX
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
DATABASE_URL=postgresql://user:pass@localhost:5432/db
NODE_ENV=development

# Ignore all environment files
.env
.env.local
.env.*.local

# Ignore IDE settings that might leak paths
.vscode/
.idea/

# Ignore dependency folders
node_modules/
__pycache__/
venv/

# Vulnerable: If an attacker injects a fake AWS_SECRET via a malicious dependency,
# the app continues running until it fails deep in the logic.
import os
def connect_aws():
    client = boto3.client('s3', aws_secret_access_key=os.getenv('AWS_SECRET'))

# Secure: The app crashes immediately if the environment is tampered with.
config = load_secure_config() 
def connect_aws():
    client = boto3.client('s3', aws_secret_access_key=config.AWS_SECRET_ACCESS_KEY.get_secret_value())