Secret Detection, Watch Mode, Auto-Fix & More

What's New in v2.0.0

A major feature update. envscan-cli now does a lot more
than audit missing vars it actively protects your
codebase from credential leaks and speeds up your workflow.

New Features

🔒 Secret-Leak Detection
Scans your real .env files for live credentials.
Detects AWS keys, Stripe live keys, GitHub tokens,
Slack tokens, Google API keys, JWTs, PEM blocks, and
high-entropy values on suspicious variable names.
Only prints the variable name and reason — never the value.

🔓 Gitignore Hygiene Check
Warns you if your .env file is not covered by .gitignore.
Catches the most common cause of accidental credential exposure.

⚡ Watch Mode
npx envscan-cli --watch
Re-runs the full audit automatically on every file change.
Useful while actively wiring up a new integration.

🔧 Auto-Fix
npx envscan-cli --fix
Appends placeholder entries to .env.example for anything
undocumented or missing. Never touches your real .env.

📄 JSON Output
npx envscan-cli --json > report.json
Machine-readable output with no ANSI codes or banner.
Safe to pipe into dashboards, tooling, or CI annotation steps.

🚀 CI Init Command
npx envscan-cli init-ci
Generates a ready-to-commit GitHub Actions workflow at
.github/workflows/envscan-cli.yml automatically.

⚙️ Config File Support
Drop envscan-cli.config.js in your project root.
Supports ignore patterns, custom .env.example path,
ignoreUnused, and secretDetection toggles.
CLI flags always override the config file.

All New Flags

--fix Auto-fix undocumented vars into .env.example
--json Machine-readable JSON output
--no-secrets Disable secret-leak detection
-w, --watch Watch mode — re-run on every change
-c, --config Custom config file path

Upgrade

npm install -g envscan-cli
npx envscan-cli@latest

Links

📦 npm: npmjs.com/package/envscan-cli
💻 GitHub: github.com/Innocent-Developer/env-doctor