A deployable application usually has behavior that varies by environment without requiring different source code.

Configuration supplies values such as database endpoints, feature parameters, resource limits or external service addresses. The built artifact should normally remain the same while configuration changes between development, test and production.

Configuration belongs outside the artifact when changing it should not require rebuilding the software. This keeps environment differences explicit and lets the same verified artifact be promoted through several environments.

Defaults should be safe and missing required values should fail clearly rather than silently selecting an unintended environment.

Secrets such as passwords or private keys are sensitive configuration, but they need stronger handling than ordinary values: they should not be committed to source control or exposed through logs and diagnostics.

Separating code, artifact and configuration makes deployments easier to reproduce because each source of variation has a defined place.