AppHandoff uses environment variables for API keys, database connection strings, and feature flags. In production, secrets are stored in Infisical and synced to the Fly.io runtime automatically. Locally, run your dev server through the Infisical CLI to inject the same secrets into process.env without committing a .env file.
Required variables include the Supabase URL and anon key, the GitHub App private key, and any third-party API tokens your scanning pipeline depends on. Optional variables control feature flags like scan frequency, notification delivery channels, and debug logging. The docs list every variable with its expected format and default value.