env-audit

Environment Variables Audit

Audit the project's environment variable files and produce a report covering missing variables, undocumented extras, and security risks.

If $ARGUMENTS is provided, use it as the path to the active env file. Otherwise auto-detect.

Step 1 — Find Environment Files

Example/template file (source of truth) — search in order:

1. .env.example
2. .env.sample
3. .env.template
4. .env.defaults

If none found, report: "No .env.example found. Cannot perform comparison audit. Consider creating one." Then continue with security-only audit of the active env file.

Active env file — search in order:

1. $ARGUMENTS (if provided)
2. .env.local
3. .env
4. .env.development
5. .env.development.local

If no active env file found, report it and stop.

Step 2 — Parse Both Files

Read each file line by line:

• Skip blank lines and lines starting with #
• Split on first =: key is everything before, value is everything after
• Strip surrounding quotes from values ("value" → value, 'value' → value)
• Collect: { key, value, hasValue: value.trim() !== "" }

Step 3 — Compare Keys

Missing variables (in example but not in active env):

• Key exists in example but not in active env
• Severity: ERROR — app likely broken without these

Undocumented extras (in active env but not in example):

• Key exists in active env but not in example
• Severity: WARNING — should be added to .env.example (without the value)

Empty variables (key exists in active env but value is blank):

• Key present but value is empty string
• Severity: WARNING if key looks important (contains SECRET, KEY, TOKEN, PASSWORD, URL, HOST)

Step 4 — Security Risk Analysis

For every variable in the active env file, check:

Hardcoded weak secrets:

• Key contains: SECRET, KEY, TOKEN, PASSWORD, PASS, PWD, AUTH, CREDENTIAL
• AND value matches any of:
  • secret, password, 123456, test, dev, development, changeme, example, placeholder, your_*, replace_*, xxx, todo
  • Value shorter than 16 characters for secret/token fields
• Severity: HIGH — replace with a strong random value