How do you manage configuration and secrets across development, staging and production for a full-stack app?
What the interviewer wants to hear
- Keep config in environment variables, not hard-coded
- Never commit secrets; commit a .env.example instead
- Use the hosting platform or a secret manager per environment
- Separate public client config from server-only secrets
- Validate required variables at startup
Model answer
I keep anything that changes between environments, such as database URLs, API keys and feature settings, in environment variables rather than in code. Locally I use a .env file that is in .gitignore, and I commit a .env.example listing the names with fake values so new developers know what to set. In staging and production the values live in the hosting platform’s settings or a secret manager like AWS Secrets Manager, with separate credentials per environment so a staging leak never touches production data. I am careful about what reaches the browser: in Next.js only NEXT_PUBLIC_ variables are bundled, so secrets never get that prefix. At startup I validate the variables with a small schema, so a missing value fails the deploy immediately instead of breaking a page later. If a secret leaks, I rotate it.
Can you answer it under time pressure?
Take a timed easy round and get scored on every answer.
More easy Full Stack Developer questions
- What happens, step by step, when a user types your app URL into the browser and presses Enter?
- Design the REST API endpoints for a simple blog with posts and comments. What URLs, methods and status codes would you use?
- What is the difference between authentication and authorization? Give an example from a web app.
- You are starting a new e-commerce app. Would you choose a SQL or a NoSQL database, and why?
- Explain client-side rendering, server-side rendering and static site generation. When would you use each?
- In a web app with a React frontend and an API, where should input validation happen, and why?
- A page loads data from your API. How do you handle loading, empty and error states so users are never left confused?
- How would you explain a database index to a junior developer, and how do you decide which columns to index?
- Describe the Git and code review workflow you follow when building a feature on a team.