v1.0.0 — Production Release: Local-First Secret Scanner & Safety Gate

EnvGuard v1.0.0 — Official Production Release 🛡️

We are thrilled to announce EnvGuard v1.0.0, our first official production release!

EnvGuard is a 100% local-first developer safety gate that catches secrets before they leave your machine, eliminates environment drift between .env and .env.example, provides automated safe remediation, and generates offline compliance audit evidence — with zero cloud dependencies, accounts, or telemetry.

---

🌟 What Makes EnvGuard Different?

• 100% Local & Privacy-Preserving: Runs entirely in local memory on your machine or CI runner. No code or credentials ever leave your system.
• Context-First Detection Pipeline: Entropy is treated as a supporting signal, not a standalone classifier. Normal identifiers, CSS styles, package names, MIME types, URLs, and mock fixtures never trigger false positives.
• Catch → Fix → Prove:
  1. Catch: Screen staged commits (check), pre-push branches (pre-push), directories (scan), or pull requests (ci).
  2. Fix: Safely extract hardcoded secrets into .env with automated .gitignore safety guards (fix --apply).
  3. Prove: Generate executive audit reports with offline SOC 2 Type II and ISO/IEC 27001:2022 control mappings (audit).

---

🚀 Key Highlights & Capabilities in v1.0.0

1. 16 Core CLI Commands

• Core Gates: init, scan, check, diff, ci
• Remediation: fix (AST-verified dry-runs and atomic .env extractions)
• Governance & Assurance: audit, baseline, status, lint-config
• Discovery & Diagnostics: rules, explain, doctor, watch
• Git Protocols: install-hook, pre-push

2. Context-First High-Entropy Redesign

• Completely re-engineered generic-high-entropy-secret rule into a semantic multi-signal pipeline requiring credential keywords or elevated symbol diversity.
• 0 False Positives verified on large-scale real-world production codebases.

3. Safe Automated Remediation (envguard fix)

• Replaces raw secrets with os.environ.get(...) references in Python code.
• Automatically creates or updates .gitignore to ensure .env is never committed to Git.
• Requires a clean Git tree (or explicit --allow-dirty) to protect against uncommitted work loss.
• Generated code is engineered to never re-trigger detection rules.

4. Enterprise Compliance & Configuration Assurance

• envguard lint-config: Strictly validates .envguard.yml and .envguard-org.yml for syntax errors, typos, unknown keys, and rule conflicts.
• envguard audit: Produces executive security grades (A+ to F), tracking legacy baseline debt separately from genuine code remediation, and exports print-ready standalone HTML / JSON reports.
• Compliance Cross-Referencing: Built-in offline mapping for SOC 2 Type II (CC6.1, CC6.6, CC6.7) and ISO/IEC 27001:2022 (A.5.15, A.8.12, A.8.24).

5. Developer & CI/CD Workflows

• Git Pre-Commit & Pre-Push Hooks: One-click install (envguard install-hook) preventing credential leaks before commits or pushes.
• Machine-Readable Outputs: Native --format json and --format sarif (SARIF 2.1.0) compatible with GitHub Code Scanning and IDEs.
• Predictable Exit Code Contract:
  • 0: Clean / Success / No blocking findings
  • 1: Blocking secrets detected / Policy violation / Environment drift
  • 2: CLI usage, configuration, or git cleanliness error
  • 3: Fatal system error

---

📦 Installation & Quick Start

Install via pip:

pip install envguard

v0.9.8 — Scanner Precision, Baseline Exclusions & Quality Fixes

What's Changed in EnvGuard v0.9.8

EnvGuard v0.9.8 addresses key findings from dogfooding and release testing of v0.9.0, focusing on scanner precision, eliminating false positives on remediated code, protecting baseline files, aligning runtime diagnostics with package constraints, and smoothing CLI path ergonomics.

🛡️ Scanner Precision: Zero False Positives on Safe Code & Remediations

• Safe code expressions ignored: Function invocations (e.g. secret_key = get_secret_key_from_vault(), get_password()) and environment variable lookups (e.g. password = os.environ.get("PASSWORD"), db_password = os.getenv("DB_PASSWORD"), database_password = os.environ.get(...)) are no longer falsely flagged by variable assignment rules.
• Secrets manager & environment recognition: Any assignment line using standard environment lookups or offline secrets managers (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, Google Secret Manager) is automatically recognized and skipped by heuristic assignment detectors.
• Refined assignment regex: Parentheses () are explicitly excluded from unquoted assignment values in patterns.json and fallback patterns.

🔕 Automatic Baseline & Config File Exclusions

• Built-in baseline ignore: .envguard-baseline.json (and all .envguard*.json / .envguard*.yml files) are now built into is_path_ignored().
• Clean pre-commit commits: Generating a baseline hash or editing EnvGuard configurations will never trigger generic-high-entropy-secret or block pre-commit hooks.

🩺 Doctor Python Floor Alignment

• Strict Python >= 3.10 verification: envguard doctor now checks sys.version_info >= (3, 10) and outputs Python X.Y.Z (Compatible >= 3.10), aligning directly with pyproject.toml.

🖥️ CLI Positional Path Consistency

• Universal path arguments: envguard baseline create [PATH], envguard doctor [PATH], envguard init [PATH], and envguard status [PATH] now accept optional positional path arguments (e.g. envguard baseline create .) alongside existing -p / --path options.

🧪 Test Suite & Packaging

• 233/233 tests passing: Added dedicated regression test suite in tests/test_v098_fixes.py.
• Wheel built: dist/envguard-0.9.8-py3-none-any.whl.
• Git: Tagged v0.9.8 and pushed to main.

EnvGuard v0.9.0 — Compliance, Configuration Assurance & Historical Audit Reporting

EnvGuard v0.9.0 — Compliance, Configuration Assurance & Historical Audit Reporting

EnvGuard v0.9.0 advances the platform from catch → fix → prove. While v0.7.0 catches secrets earlier in developer workflows and v0.8.0 remediates them safely, v0.9.0 provides deep configuration assurance, compliance context, and audit evidence for security and engineering teams.

Everything runs 100% locally — zero network requests, no accounts, and no cloud dependencies.

---

What's New in v0.9.0

1. Configuration Assurance Linter (envguard lint-config)

Ensure your security policies are active, valid, and free of contradictions before commits or scans execute.

• Unified Schema Validation: Validates field types, allowed severities, and structure against load_config().
• Typo & Unknown Key Detection: Flags misspelled or unexpected keys across top-level, scan, rules, ci, and advanced_detection sections.
• Rule ID Catalog Check: Validates disabled rules and severity overrides against the 25 built-in patterns in patterns.json.
• Conflict Analysis: Catches contradictory configurations (e.g. marking a rule simultaneously as disabled and overridden with a severity).
• Organization Policy Guardrails: Enforces security floors from .envguard-org.yml to prevent local configurations from loosening required rules or block thresholds.
• Git Repository Risk Checks: Verifies .env Git index tracking and .gitignore status to eliminate accidental credential exposure paths.

# Lint repository configuration and git exposure safety
envguard lint-config

# Machine-readable JSON output
envguard lint-config --format json --output lint-report.json

v0.8.7 — Remediation Safety Fixes

Highlights

This release fixes three issues found during live verification of v0.8.0's new envguard fix command. All three affected real, common scenarios rather than obscure edge cases, and are fixed here before fix sees wider use.

Fixed

• fix failed to parse files containing a UTF-8 byte-order-mark (BOM) — scan, check, and ci have always correctly handled BOM-prefixed files (the default output of Out-File -Encoding utf8 in PowerShell), but fix's code-rewriting logic rejected them with a "Failed to parse Python syntax: invalid non-printable character U+FEFF" error, reporting them as requiring manual remediation. fix now handles BOM-prefixed files the same way the rest of EnvGuard always has.

• fix --apply could leave a real secret exposed to Git — after moving a hardcoded secret into .env, fix did not ensure .env was excluded from version control. In a repository with no existing .gitignore, this left the newly created .env — containing the real, unmasked secret value — as a plain untracked file, one git add . away from being committed into Git history. fix --apply now automatically creates or updates .gitignore to exclude .env and its common variants (.env.local, .env.*.local) as part of every remediation.

• fix incorrectly re-scanned .env as source code — after .env was populated with a real secret value, a subsequent fix run detected that secret inside .env itself and proposed rewriting it, producing a meaningless no-op diff. .env and .env.example are now correctly excluded from fix's scan targets, since they are remediation destinations, not source files to be remediated.

Verified in this release

• All three fixes reproduced against the exact failing scenarios from v0.8.0 before the fix, and reconfirmed resolved afterward using the same reproduction steps.
• Re-verified that fix's core safety behaviors — dry-run-by-default, refusal to run on a dirty Git working tree, and the fallback for structurally unsafe rewrites (f-strings, conditional expressions, function calls) — continue to work correctly and were unaffected by these fixes.
• Confirmed the new .gitignore entry is created with real content (.env, .env.local, .env.*.local) and that git status no longer flags a freshly created .env as requiring attention.

---

Recommendation: Anyone who used envguard fix --apply under v0.8.0 should check their repository's .gitignore and confirm .env was not committed before this fix was available.

EnvGuard v0.8.0 — Automated Remediation & Secrets Manager Integration

What's Changed in EnvGuard v0.8.0

EnvGuard v0.8.0 is the first write-capable release, introducing automated secret remediation and enterprise secrets manager recognition built around a strict safety-over-automation philosophy.

---

🚀 Key Features & Enhancements

1. Automated Secret Remediation (envguard fix)

• Safe Code Rewrites: Converts hardcoded Python assignments directly into os.environ.get("ENV_VAR_NAME").
• Safe Import Injection: Injects import os directly after module docstrings or top-level comments if not already present.
• Dual Environment Synchronization:
  • Saves extracted secrets directly into .env.
  • Synchronizes .env.example using strictly sanitized placeholders ("your-secret-key-here"), guaranteeing plaintext secrets are never written into version control.
• Terminal Diffs: Displays clean, colored unified diffs of all proposed modifications before and after application.

2. Strict Safety Rails

• Dry-Run by Default: Never modifies source files or environment files without the explicit --apply flag.
• Git Working Tree Protection: Requires a clean Git working tree before modifying code to prevent corrupting uncommitted changes (overridable with --allow-dirty).
• AST Validation Gate: Leverages Python's Abstract Syntax Tree (ast) to inspect assignments. Multiline strings, dict literals, f-strings, and complex expressions are safely preserved untouched and flagged for manual review.
• Atomic Writes with Rollback: Prepares modified files and applies changes atomically, restoring in-memory backups if any file operation fails.

3. 100% Offline Secrets Manager Recognition

• Pattern-recognition for enterprise secret stores and environment lookups:
  • AWS Secrets Manager (boto3.client("secretsmanager"), get_secret_value)
  • HashiCorp Vault (hvac.Client, client.secrets.kv, vault.read)
  • Azure Key Vault (azure.keyvault.secrets, SecretClient, get_secret)
  • Google Cloud Secret Manager (google.cloud.secretmanager, SecretManagerServiceClient, access_secret_version)
  • Environment Lookups (os.environ.get, os.getenv, os.environ[...])
• Zero cloud SDK credentials, zero network calls, and zero external dependencies.
• Files/lines already utilizing secrets managers are detected and excluded from blind rewrites.

4. Credential Rotation Advisory

• Displays prominent warnings post-remediation reminding developers that exposed secrets must be revoked and rotated at the provider level.

---

🧪 Test Suite & Quality Assurance

• 208 tests passing (pytest tests/ -q).
• Full regression test coverage for AST safety, diffing, import injection, Git tree cleanliness, and secrets manager detection.

---

📦 Installation & Upgrade

Install from wheel:

pip install dist/envguard-0.8.0-py3-none-any.whl

v0.7.5 — Full Rich Terminal UI Overhaul

Highlights

A complete visual overhaul of EnvGuard's terminal output. Every command now renders through a single, shared styling system, and the interface gains progress indication, a live-updating watch panel, and syntax-highlighted findings — all while preserving every existing command's behavior and output data exactly as before.

Added

• Unified theme system — severity colors, panel styles, and table formatting are now defined in one central module and used consistently across every command (check, scan, ci, status, doctor, diff, install-hook, baseline, init, explain, rules list, and the interactive menu). Previously, styling was implemented independently per command; this release closes that gap so the visual language is identical everywhere.

• Progress indication for long-running scans — scan, ci, and multi-repo scans now show a live spinner/progress indicator while scanning larger codebases, instead of appearing to hang until the final report prints. This indicator is automatically suppressed in CI environments and whenever output isn't an interactive terminal (piped output, --format json/--format sarif), so it never pollutes CI logs or structured output.

• envguard watch live panel — the plain output from v0.7.0 is replaced with a live-updating rich.live panel showing the watched directory, tracked file count, current status, and last-checked time. The panel updates in real time as file changes are detected and rescanned, and shuts down cleanly on Ctrl+C.

• Syntax-highlighted finding snippets — check, scan, and ci text output now show the actual flagged source line with syntax highlighting, alongside the existing masked value, making findings easier to place in context at a glance. Masking is always applied before highlighting — the real secret value is never passed to the syntax renderer.

• Rich traceback rendering for unexpected errors — any genuinely unanticipated crash now renders as a readable Rich traceback instead of a raw Python stack dump. This does not affect any of EnvGuard's existing clean, custom error panels (EnvGuard Error, ConfigurationError, GitError, etc.), which continue to render exactly as before.

Verified in this release

• Full command sweep (check, scan, status, doctor, ci, watch) confirmed visually consistent and functionally unchanged from prior versions — same finding counts, same severities, same JSON/SARIF schemas.
• Masking-before-highlighting confirmed directly: flagged secrets in rendered snippets are shown in masked form only.
• Progress spinner confirmed to render during normal interactive scans and confirmed absent when CI=true is set, regardless of terminal capability.
• watch's live panel confirmed to detect and reflect real file changes during an active session, and to shut down cleanly on Ctrl+C with no traceback.
• No functional regressions found across a full live verification pass — the first release in this project's history to complete verification with zero bugs identified.

---

This release is purely visual and structural — no changes to detection logic, configuration handling, Git operations, or scanning behavior. Every finding, exit code, and data format from v0.7.0 remains identical.

v0.7.0 — Developer Workflow Integration (Git Pre-Push Hook, Filesystem Watcher, IDE JSON)

🚀 What's New in v0.7.0

1. Production Git Pre-Push Hook (envguard pre-push & envguard install-hook --type pre-push)
   A dedicated gate before outgoing commits reach remote branches:

Full Git Protocol Compliance: Intercepts Git's stdin stream ( ) across single, multiple, or tag pushes.
Deep Commit Range Resolution: Automatically calculates rev-list remote_sha..local_sha for updates, --not --remotes for new branches, and cleanly handles branch deletions (0000... or (delete)).
True Git Object Inspection: Scans files across outgoing commits directly from Git objects using git diff-tree and git show :, catching intermediate leaks in commit chains even if undone in subsequent commits.
Injection Defense in Depth: Strictly rejects ref names, SHAs, or remote arguments beginning with - or containing null bytes, and terminates commands with --.
One-Step Installation:
bash

envguard install-hook --type pre-push
2. Zero-Dependency Filesystem Watch Mode (envguard watch [PATH])
Continuous monitoring detects secrets the moment files are saved to disk — right from your terminal:

100% Python Standard Library: Implemented using native os.scandir and filesystem mtime_ns / size caching with zero third-party dependencies (no watchdog).
Debounced Event Processing: Configurable debounce interval (default 0.3s) batches rapid file saves, preventing scan storms and duplicate alerts.
Intelligent Pruning: Automatically prunes .git, node_modules, venv, build, dist, pycache, and respects .gitignore and .envguardignore.
Single Detection Engine: Reuses the core streaming engine for identical detection accuracy across all commands.
bash

Watch current directory

envguard watch

Watch specific directory with custom debounce

envguard watch ./src --debounce 0.5
3. Editor & IDE Diagnostic JSON (--format ide)
A standardized, versioned JSON schema (schema_version: 1) engineered for IDE extensions, Language Server Protocol (LSP) daemons, and editor diagnostics (VS Code, JetBrains, Neovim):

1-Based Character Coordinates: Every finding includes deterministic line, column, end_line, and end_column properties with safe fallback coordinates (min: 1).
Guaranteed Privacy: Plaintext secrets are strictly masked (masked_value) and never exposed in the JSON output.
Command Support:
bash

envguard scan --format ide
envguard ci --format ide
🔒 Security & Policy Consistency
Full Organization Floor Enforcement: Pre-push and watch modes honor both local .envguard.yml and organization .envguard-org.yml policies with transparent blocker attribution (organization policy vs local policy).
Cryptographic Baseline Compatibility: Existing baseline fingerprints (.envguard-baseline.json) are seamlessly respected across pre-push scans without masking new leaks.
100% Local & Zero Telemetry: All scans, diffs, and watch events execute strictly on local CPU and memory.
🧪 Verification & Test Suite
EnvGuard v0.7.0 passes 190 of 190 tests (100%):

text

============================= 190 passed in 22.23s =============================
tests/test_v070_pre_push.py — Stdin protocol parsing, delete handling, injection defense, commit range resolution, blocking alert screens.
tests/test_v070_watch.py — Directory baseline snapshots, debounce settling, instant secret detection, file deletions, clean Ctrl+C shutdown.
tests/test_v070_ide_json.py — Schema validation (schema_version: 1), 1-based character ranges, safe fallbacks, secret masking.
📦 Installation
From wheel:

bash

pip install dist/envguard-0.7.0-py3-none-any.whl
Developer editable mode:

bash

git clone https://github.com/neil-data/envGUARD.git
cd envGUARD
git checkout v0.7.0
pip install -e .
Verify:

bash

envguard --version

Output: EnvGuard version 0.7.0

EnvGuard v0.6.6 — Organization Policy Schema Fix & Multi-Repo Scan Stability

What's Changed in EnvGuard v0.6.6

EnvGuard v0.6.6 is a patch release fixing two critical issues in the v0.6.x organization policy and multi-repository scanning workflows:

1. Organization Policy locked_disabled_rules Schema Alignment (Bug A)

• Fixes False-Positive Warnings: Fixed a validator/schema mismatch where defining locked_disabled_rules in .envguard-org.yml triggered an erroneous "Unknown top-level key" warning.
• Diagnostics & Status Consistency: envguard doctor (Check 5b) and envguard status now recognize locked_disabled_rules as a first-class schema field, reporting PASS and ACTIVE without spurious warnings.
• Strict Schema Enforcement: Validates that locked_disabled_rules is a list of rule IDs and integrates them into the composite policy floor.

2. Multi-Repository Scan Stability Fix (Bug B)

• Fixes Scan Crash with Findings: Fixed a TypeError (print_scan_findings() got an unexpected keyword argument 'files_scanned') that crashed envguard scan --repos in default text output mode whenever any scanned repository contained active findings.
• Unified Findings Presentation: Multi-repo scans now cleanly display both the high-level repository summary table and the detailed secret findings table across all repositories.

---

Verification

• Automated Tests: 169 passed (pytest tests/).
• 100% Local: Zero network telemetry, zero cloud backends.

v0.6.0 — Team & Multi-Repo Workflows

Highlights

EnvGuard extends beyond single-repo, single-developer use for the first time — while staying fully local-first, with no accounts, no cloud sync, and no new backend. Team policy and multi-repo scanning are both built on version-controlled files, the same way .gitignore works.

Added

• Org policy file (.envguard-org.yml) — a shared, git-committed policy that sits alongside .envguard.yml. Lets a team set a security floor that individual repos can extend but not weaken: a block_on minimum that local config can only add to, and a list of rules that cannot be disabled at the local level no matter what an individual .envguard.yml says.
• Multi-repo scanning — envguard scan --repos <paths> (or --repos-file) scans multiple local repository checkouts in one run and produces a single combined report, with each finding attributed to its source repository. A broken or inaccessible repo in the list is reported clearly and skipped without aborting the scan of the others.
• Org policy visibility in diagnostics — doctor and status now report whether an org policy is present, valid, and being honored, and clearly attribute any policy violation to its source (org vs. local) rather than reporting an ambiguous failure.

Design notes

• Org policy and local config are evaluated independently for most settings — an org policy cannot silently override a repo's local exclusions or custom rules, only enforce a floor on block_on severities and lock specific rules from being disabled.
• All new path/reference handling in this release follows the same strict validation introduced in v0.5.4 after the Git reference injection fix — no new field in this release accepts unsanitized input that reaches a subprocess or filesystem write.
• Existing single-repo, no-org-policy usage is completely unchanged — this release is purely additive.

Deferred to a future release

Team-committed baselines (shared suppression with audit trail), directory-walking org policy discovery, and role-based enforcement beyond the block_on/disabled_rules floor are intentionally out of scope for v0.6.0 and planned for a later release, to keep this release's enforcement logic small enough to audit thoroughly.

---

Recommendation: Teams managing more than one EnvGuard-protected repository should adopt a shared .envguard-org.yml to prevent individual repos from silently weakening security gates.

v0.5.5 — Status Command Fixes

Highlights

This is a small, targeted patch closing out the last two items from the v0.5.4 audit — both isolated to status_cmd.

Fixed

• envguard status --verbose / -v crashed with TypeError — a debugging aid added to surface configuration warnings called Rich's Console.print() with an unsupported file keyword argument, causing status --verbose to fail every time instead of showing the intended warning. This has been corrected, and --verbose/-v now print configuration warnings cleanly without error.

• status silently hid configuration warnings — a repository with a typo'd or unrecognized key in .envguard.yml (e.g. disbaled_rules instead of disabled_rules) was correctly flagged by doctor, but status gave no indication anything was wrong, reporting Configuration: VALID regardless. status now surfaces the same warning doctor does — in both plain and verbose output — and the Configuration row in the status table correctly reflects WARNING when a configuration issue is present, instead of VALID.

Verified in this release

• Reproduced both issues live against v0.5.4 before the fix, and reconfirmed both are resolved in v0.5.5 using the same reproduction steps.
• status and doctor now agree on configuration validity in every tested case, closing the loop on the broader status/doctor consistency work from v0.5.3 and v0.5.4.

---

Status after this release: every bug identified across the v0.4.0 → v0.5.4 audit cycle (18 findings total) is now resolved. No known open issues heading into v0.6.0.