dotenv-audit

To scan for exposed secrets in .env files, audit environment files and code to detect tracked .env variants, hardcoded API keys, and os.Getenv usage. This process flags potential credential exposures and verifies .gitignore coverage before you push to a shared repository.

The best way to check if .env files are ignored is to audit .gitignore coverage for tracked and untracked .env variants. This audit identifies ignored environment files and flags any committed .env files that bypassed gitignore rules.

Prevent hardcoded API keys from leaking by auditing source code and log messages for exposed credentials. The audit flags secrets directly in code and runtime logs, ensuring environment variables are used safely instead of hardcoded values.

Yes, a .env.example file is needed to maintain environment variable discipline. The audit verifies your os.Getenv usage aligns with a central .env.example file, guiding remediation and ensuring all required environment variables are documented.

Environment variables appear in logs when secret leakage occurs in runtime messages. The audit scans your code and log hygiene to flag potential secret leakage, identifying where sensitive values are being printed or logged during application execution.

Yes, you can audit environment files and code for secrets without extra dependencies. The dotenv-audit tool operates independently with no required dependencies, directly scanning your project structure for .env variants and hardcoded credentials.