v2.0.3 Release engineering only — no CLI functionality changes

• Adds CI (GitHub Actions): runs on every PR and push to main across Node 18/20/22
• Adds a tag-triggered release workflow publishing to npm via Trusted Publishing (OIDC) — no stored npm token, automatic provenance attestations
• Adds repository/homepage/bugs to package.json
• Adds CI/version/license badges and a Releases & Provenance section to the README

v2.0.2 - Adds --strict (fail build on undocumented/unused, not just missing), --suggest (fuzzy-match typo suggestions for missing vars), and .envscanignore (global ignore file, gitignore-style)

give me line or realse note GitHub markdown

v2.0.2
Adds --strict, --suggest, and .envscanignore.

--strict — fails the build on undocumented and unused vars too, not just missing
--suggest — fuzzy-matches missing vars against .env.example and suggests the closest name (e.g. "Did you mean DB_URL instead of DATABASE_URL?")
.envscanignore — a .gitignore-style file for globally ignored variable names/patterns, merged with the config file's ignore array

Full Changelog: v2.0.1...v2.0.2

v2.0.1 - Hotfix: Republish with actual v2 codebase

v2.0.1 — Hotfix Release

The previous npm publish was stale — the v2 features
were documented but the old codebase was still shipping.
This release fixes that.

What this fixes

• npm package now matches the actual v2 codebase
• --fix works as documented
• --json works as documented
• --watch works as documented
• init-ci works as documented
• Banner correctly shows v2.0.1 instead of v1.0.0

No new features

This is a republish-only release. No logic changes.
All v2 features were documented in v1.1.0 — they
just weren't shipping correctly until now.

Upgrade

npm install -g envscan-cli@latest

or run directly:

npx envscan-cli@latest

Verify your version

npx envscan-cli --version
→ should print: 2.0.1

📦 npmjs.com/package/envscan-cli
💻 github.com/Innocent-Developer/env-doctor

Secret Detection, Watch Mode, Auto-Fix & More

What's New in v2.0.0

A major feature update. envscan-cli now does a lot more
than audit missing vars it actively protects your
codebase from credential leaks and speeds up your workflow.

New Features

🔒 Secret-Leak Detection
Scans your real .env files for live credentials.
Detects AWS keys, Stripe live keys, GitHub tokens,
Slack tokens, Google API keys, JWTs, PEM blocks, and
high-entropy values on suspicious variable names.
Only prints the variable name and reason — never the value.

🔓 Gitignore Hygiene Check
Warns you if your .env file is not covered by .gitignore.
Catches the most common cause of accidental credential exposure.

⚡ Watch Mode
npx envscan-cli --watch
Re-runs the full audit automatically on every file change.
Useful while actively wiring up a new integration.

🔧 Auto-Fix
npx envscan-cli --fix
Appends placeholder entries to .env.example for anything
undocumented or missing. Never touches your real .env.

📄 JSON Output
npx envscan-cli --json > report.json
Machine-readable output with no ANSI codes or banner.
Safe to pipe into dashboards, tooling, or CI annotation steps.

🚀 CI Init Command
npx envscan-cli init-ci
Generates a ready-to-commit GitHub Actions workflow at
.github/workflows/envscan-cli.yml automatically.

⚙️ Config File Support
Drop envscan-cli.config.js in your project root.
Supports ignore patterns, custom .env.example path,
ignoreUnused, and secretDetection toggles.
CLI flags always override the config file.

All New Flags

--fix Auto-fix undocumented vars into .env.example
--json Machine-readable JSON output
--no-secrets Disable secret-leak detection
-w, --watch Watch mode — re-run on every change
-c, --config Custom config file path

Upgrade

npm install -g envscan-cli
npx envscan-cli@latest

Links

📦 npm: npmjs.com/package/envscan-cli
💻 GitHub: github.com/Innocent-Developer/env-doctor

v1.0.0 — Initial Release

env-doctor v1.0.0

Audit your environment variables before they break production.

What it detects

• ✖ Missing — used in code but not defined in any .env file
• ⚠ Undocumented — in .env but missing from .env.example
• ○ Unused — defined in .env but never used in code

Usage

npx env-doctor

Options

--dir Directory to scan
--example Custom .env.example path
--ignore-unused Suppress unused warnings

Install

npm install -g env-doctor