env-sentry 1.0.0 — the toolkit release

env-sentry 1.0.0 — the toolkit release 🛡️

env-sentry is no longer "a script that checks your .env". It is a complete, still zero-dependency .env toolkit: twenty commands covering the whole lifecycle of an environment file — create it, lint it, fill it, compare it, audit it, export it, and keep it out of git.

pip install --upgrade env-sentry

Highlights

New commands

Command	Why you'll use it
lint	Catch files that don't parse: duplicate keys, unquoted spaces, unterminated quotes, CRLF, BOM, missing newline
diff	Compare two env files with values masked by default — safe to paste in a PR
merge	Add keys from a template without touching comments or ordering
prune	Delete dead keys (dry-run by default, .env.bak backup)
usage	Find keys nothing reads and os.environ calls with no definition
gen	Generate CSPRNG secrets for placeholder keys, with passphrases for passwords
audit	Eleven weighted checks → 0–100 score + A+…F grade, --min-score CI gate
badge	Render that score as an SVG badge for your README
stats	Key categories, entropy distribution, reused values, weak secrets
export	.env → JSON / YAML / shell / compose / Kubernetes Secret / tfvars / INI / CSV
history	Find secrets still recoverable from git history
hooks	Install a safe pre-commit / pre-push hook (clean uninstall)
ci	Generate GitHub Actions (SARIF upload), GitLab CI or pre-commit config
config	Project defaults via .env-sentry.json
completions	bash / zsh / fish completions generated from the live CLI
watch	Re-run checks whenever an env file changes
doctor	One-screen diagnosis of git, hooks, permissions, config, CI wiring

A real detection engine

• 45+ provider signatures — AWS, Google/Firebase, Azure, DigitalOcean, Cloudflare, Heroku, GitHub (incl. fine-grained PATs), GitLab, Bitbucket, Stripe, Square, Braintree, PayPal, Slack, Discord, Telegram, Twilio, SendGrid, Mailgun, Mailchimp, OpenAI, Anthropic, Hugging Face, Replicate, Groq, Perplexity, OpenRouter, npm, PyPI, Shopify, Datadog, New Relic, Postman, Sentry DSN, Supabase, Vercel, private keys, JWTs, bearer tokens, credentials in URLs.
• Shannon-entropy heuristics for everything else.
• Severities per finding, --fail-on critical|high|…, redacted previews.
• --format text|json|sarif|github, --output, --min-severity, --staged.
• Allowlists (.env-sentry-allow) with rule:, path: and literal entries; inline env-sentry:ignore.

Everything got better

• Real .gitignore matching: *.env, .env*, anchored and nested patterns, negation. No more false alarms, no more false passes for .env.staging.
• scan is gitignore-aware: ignored files can't leak, so they aren't flagged (that made hooks fail on every commit). --include-ignored for the exhaustive view.
• Comment-preserving parser with quotes, escapes, multi-line values and export prefixes.
• sync regenerates templates with context-aware placeholders and refuses to wipe a hand-written template from an empty .env.
• check reports duplicates and empty values, adds --strict/--ci and --format json.
• init ships nine stack templates (fastapi, django, nextjs, node, rails, laravel, go, docker, generic), --create-env with mode 600, and smarter .gitignore coverage.
• Colour output with NO_COLOR support, -q/--quiet, --color auto|always|never, and python -m env_sentry.

Two-command setup

env-sentry init --template fastapi   # scaffold a real template
env-sentry gen                       # seed .env + generate its secrets

Quality

• 218 tests across every module, all green on Python 3.8 / 3.10 / 3.12
• pyflakes-clean package, zero runtime dependencies
• No network calls, no telemetry, secrets are never printed unmasked by default

Notes

• Everything from 0.1.x keeps working; the new command surface is additive.
• The v1.0.0 tag triggers the existing PyPI publish workflow.

Full changelog: CHANGELOG.md