envcheck

Catch broken .env files and leaked secrets in CI

Open Source

Developer Tools

GitHub

Visit WebsiteSee on Product HuntGumroad ⧉

Hey Product Hunt 👋 I built envcheck after two incidents I suspect are universal: a deploy that passed CI and then crashed on boot because `.env.production` was missing one key — and an API key that got committed and had to be rotated in a panic at 11pm. Both are cheap to catch if something actually checks, every build, forever. Humans are bad at "every build, forever," so I wrote a script that isn't: - `envcheck check .env --example .env.example` — missing keys, duplicates, empty values, and values still equal to the placeholder default (`API_KEY=your-key-here` boots fine and fails confusingly later) - `envcheck scan .` — 15+ known token formats (AWS, GitHub, Stripe, Slack, Google, JWT, private keys) plus Shannon-entropy heuristics for formats nobody wrote a regex for - Matches are redacted so reports are safe to archive; `node_modules`, lockfiles, and source maps are skipped; placeholder values don't false-positive - Exit codes 0/1/2 and `--json` on every command — two lines to add to GitHub Actions or GitLab CI Design principles: zero runtime dependencies, no config required, works offline, and noise control first — a scanner that cries wolf gets disabled within a week. Honest limitations: it scans working-tree files, not git history (if a key was ever committed, rotate it — scrubbing history isn't enough), and very short random tokens can fall below the entropy floor. It's completely free, and you get the complete MIT-licensed source — audit every line, it's yours — plus example files and the full 65-test suite so you can verify every claim on this page. Happy to answer anything about the entropy filtering, the schema format, or the false-positive tuning, which was genuinely the hardest part.