This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
Product upvotes vs the next 3
Waiting for data. Loading
Product comments vs the next 3
Waiting for data. Loading
Product upvote speed vs the next 3
Waiting for data. Loading
Product upvotes and comments
Waiting for data. Loading
Product vs the next 3
Loading
envcheck
Catch broken .env files and leaked secrets in CI
envcheck is a zero-dependency CLI that validatesenv files against your example file or a JSON schema, and scans your repo for leaked secrets (AWS, GitHub, Stripe, + entropy heuristics). Redacted output, exit codes your CI understands, MIT source included.
Hey Product Hunt 👋
I built envcheck after two incidents I suspect are universal: a deploy that passed CI and then crashed on boot because `.env.production` was missing one key — and an API key that got committed and had to be rotated in a panic at 11pm.
Both are cheap to catch if something actually checks, every build, forever. Humans are bad at "every build, forever," so I wrote a script that isn't:
- `envcheck check .env --example .env.example` — missing keys, duplicates, empty values, and values still equal to the placeholder default (`API_KEY=your-key-here` boots fine and fails confusingly later)
- `envcheck scan .` — 15+ known token formats (AWS, GitHub, Stripe, Slack, Google, JWT, private keys) plus Shannon-entropy heuristics for formats nobody wrote a regex for
- Matches are redacted so reports are safe to archive; `node_modules`, lockfiles, and source maps are skipped; placeholder values don't false-positive
- Exit codes 0/1/2 and `--json` on every command — two lines to add to GitHub Actions or GitLab CI
Design principles: zero runtime dependencies, no config required, works offline, and noise control first — a scanner that cries wolf gets disabled within a week.
Honest limitations: it scans working-tree files, not git history (if a key was ever committed, rotate it — scrubbing history isn't enough), and very short random tokens can fall below the entropy floor.
It's completely free, and you get the complete MIT-licensed source — audit every line, it's yours — plus example files and the full 65-test suite so you can verify every claim on this page. Happy to answer anything about the entropy filtering, the schema format, or the false-positive tuning, which was genuinely the hardest part.
About envcheck on Product Hunt
“Catch broken .env files and leaked secrets in CI”
envcheck was submitted on Product Hunt and earned 0 upvotes and 1 comments, placing #45 on the daily leaderboard. envcheck is a zero-dependency CLI that validatesenv files against your example file or a JSON schema, and scans your repo for leaked secrets (AWS, GitHub, Stripe, + entropy heuristics). Redacted output, exit codes your CI understands, MIT source included.
On the analytics side, envcheck competes within Open Source, Developer Tools and GitHub — topics that collectively have 627.5k followers on Product Hunt. The dashboard above tracks how envcheck performed against the three products that launched closest to it on the same day.
Who hunted envcheck?
envcheck was hunted by Kimi. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
For a complete overview of envcheck including community comment highlights and product details, visit the product overview.
Kimi