What is setup-env-variables?

Guidance for configuring environment variables, which are settings stored outside application code, in React and Next.js applications.

Use it to create environment-variable templates and files, distinguish browser-visible values from server-only values, and validate settings for APIs, databases, authentication, OAuth, and payment services.

It helps keep local, development, and production settings organized and prevents server-only values such as database URLs and secret keys from being exposed in the browser.

setup-env-variables — Command by Farzannajipour

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/farzannajipour/cursor-react-rules/setup-env-variables

Clone the repo

git clone --depth 1 https://github.com/Farzannajipour/cursor-react-rules

Made for: Cursor.

Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 1,729 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00000	$0.01729
Opus 5	$0.00000	$0.00864
Sonnet 5	$0.00000	$0.00346
Haiku 4.5	$0.00000	$0.00173

Measured 2d ago against content hash 5d8b6a805239, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

setup-env-variables scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

const data = await fetch(env.NEXT_PUBLIC_API_URL, {

.cursor/commands/setup-env-variables.md · 306 lines

How it starts

The opening of the file, as written. The whole thing — 306 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Setup Environment Variables

Overview

Properly configure and validate environment variables for React/Next.js applications.

Next.js Environment Variables

Types of Variables

Public (Client-side): Prefix with NEXT_PUBLIC_
- Exposed to the browser
- Safe for client code
- Example: NEXT_PUBLIC_API_URL
Server-only: No prefix
- Only available on server
- Never exposed to browser
- Example: DATABASE_URL, API_SECRET

File Structure

.env.local          # Local development (gitignored)
.env.development    # Development defaults
.env.production     # Production defaults
.env.example        # Template for team (committed)

Setup Steps

1. Create .env.example

# .env.example
# API Configuration
NEXT_PUBLIC_API_URL=
DATABASE_URL=
# Authentication
NEXTAUTH_SECRET=
NEXTAUTH_URL=
# OAuth
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
# External Services
STRIPE_SECRET_KEY=
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=

2. Create .env.local

# .env.local
NEXT_PUBLIC_API_URL=http://localhost:3000/api
DATABASE_URL=postgresql://user:password@localhost:5432/mydb
NEXTAUTH_SECRET=your-secret-key-min-32-characters
NEXTAUTH_URL=http://localhost:3000

3. Add to .gitignore

# .gitignore
.env*.local
.env.production

Type-Safe Environment Variables

Using Zod

// lib/env.ts
import { z } from 'zod';

// Define schema
const envSchema = z.object({
  // Node
  NODE_ENV: z.enum(['development', 'production', 'test']),
  
  // Public
  NEXT_PUBLIC_API_URL: z.string().url(),
  NEXT_PUBLIC_APP_URL: z.string().url(),
  
  // Server-only
  DATABASE_URL: z.string().min(1),
  NEXTAUTH_SECRET: z.string().min(32),
  NEXTAUTH_URL: z.string().url(),
  
  // OAuth
  GOOGLE_CLIENT_ID: z.string().optional(),
  GOOGLE_CLIENT_SECRET: z.string().optional(),
  
  // External Services
  STRIPE_SECRET_KEY: z.string().optional(),
  RESEND_API_KEY: z.string().optional(),
});

// Parse and export
export const env = envSchema.parse({
  NODE_ENV: process.env.NODE_ENV,
  NEXT_PUBLIC_API_URL: process.env.NEXT_PUBLIC_API_URL,
  NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
  DATABASE_URL: process.env.DATABASE_URL,
  NEXTAUTH_SECRET: process.env.NEXTAUTH_SECRET,
  NEXTAUTH_URL: process.env.NEXTAUTH_URL,
  GOOGLE_CLIENT_ID: process.env.GOOGLE_CLIENT_ID,
  GOOGLE_CLIENT_SECRET: process.env.GOOGLE_CLIENT_SECRET,
  STRIPE_SECRET_KEY: process.env.STRIPE_SECRET_KEY,
  RESEND_API_KEY: process.env.RESEND_API_KEY,
});

// Type inference
export type Env = z.infer<typeof envSchema>;

Read the full file on GitHub · 306 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 306 lines · 0 tokens per session scan A 5d8b6a805239

Subscribe to this mod's changes

setup-env-variables is a command published in the GitHub repository Farzannajipour/cursor-react-rules (3 stars, last pushed 7mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,729 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Browser automation Frontend Security

setup-env-variables