Audit .env files for security issues before they reach git

The worst part about leaking a secret in a commit isn't the moment it happens — it's that the value is now frozen in your git history. You can delete the file, rewrite history, and force-push, but clones, forks, and CI caches already have it. The only reliable defense is to catch problems before the commit is written.

Envault ships rh-envault scan, a security auditor for .env files. It checks for weak secrets, hardcoded credentials, insecure file permissions, and missing .gitignore entries — then exits non-zero when it finds critical or high-severity issues, so whatever wraps it (a hook, a CI step) stops the problem before it ships.

Install

# from source (not on public PyPI)
pip install git+https://github.com/Coding-Dev-Tools/envault.git

Python 3.10+. MIT licensed.

Scan your .env files

The core command audits one or more .env files for security issues:

# scan a single .env file
rh-envault scan .env

# scan multiple environment files at once
rh-envault scan .env.dev .env.staging .env.prod

# get machine-readable output for CI
rh-envault scan .env --json

# show info-level findings and suggestions too
rh-envault scan .env --verbose

Scan checks for: weak or commonly-used secret values, hardcoded credentials that should be in a vault, file permissions that expose the file to other users, and .gitignore entries that would let the file be committed. When it finds critical or high-severity issues, it exits with a non-zero code automatically — no extra flag needed.

Wire it into a pre-commit hook

Add a hook so every commit is checked before it's written. Create .git/hooks/pre-commit:

#!/bin/sh
# block commits when .env files have security issues
rh-envault scan .env

Make it executable (chmod +x .git/hooks/pre-commit). The next time you stage a .env file with a weak secret or world-readable permissions, the commit is refused with the finding printed. You fix it, unstage, and recommit.

Catch environment drift in CI

Scanning for security issues is one half. The other is knowing when environments are out of sync — when staging has a key that production doesn't, or vice versa. rh-envault diff compares environment files:

# compare two environments
rh-envault diff dev staging

# fail CI when staging is missing keys that dev has
rh-envault diff dev staging --fail-on-missing

--fail-on-missing exits non-zero when the source environment has keys absent in the target — the mode you want in a CI gate to catch drift before a deploy fails at runtime.

Used together, scan (catch security issues in .env files) and diff --fail-on-missing (catch environment drift) give you two independent checks on every commit and every deploy.

Run the same checks in CI

A local hook is great until someone --no-verifys their way past it. Mirror the checks in CI:

# .github/workflows/env-check.yml (excerpt)
- name: Audit .env security
  run: rh-envault scan .env --json
- name: Check environment parity
  run: rh-envault diff staging prod --fail-on-missing

What it costs

The scan, diff, sync, and audit commands are free on the local CLI. Secret-store integrations (AWS SSM, HashiCorp Vault, Doppler, 1Password Connect), unlimited audit history, team shared configs, and compliance exports unlock at paid tiers: Individual $12/mo, the 11-tool Suite $49/mo, Team $79/mo. Enterprise is custom.

Get started

pip install git+https://github.com/Coding-Dev-Tools/envault.git
rh-envault init my-project
rh-envault scan .env

MIT. No telemetry.