EnvGuard v0.4.0 — Advanced Detection Engine
EnvGuard v0.4.0 introduces the biggest detection upgrade yet.
This release moves EnvGuard beyond traditional pattern matching by introducing a multi-signal detection engine that combines known secret patterns, entropy analysis, JWT validation, context-aware detection, and false-positive protection.
What's New
Advanced Multi-Signal Detection
EnvGuard now evaluates potential secrets using multiple signals instead of relying only on regex patterns.
The new detection engine combines:
Known secret patterns
Shannon entropy analysis
Credential-like variable names
Token length analysis
Provider prefixes
Placeholder detection
Non-secret context filtering
This helps EnvGuard detect suspicious credentials while reducing unnecessary false positives.
High-Entropy Secret Detection
EnvGuard can now detect potentially generated secrets that don't match a known provider pattern.
For example, a random-looking value assigned to variables such as:
API_TOKEN
SECRET_KEY
DATABASE_PASSWORD
ACCESS_TOKEN
CLIENT_SECRET
can be analyzed using Shannon entropy and contextual signals.
Known non-secret values such as hashes, UUIDs, version identifiers, checksums, and build IDs are filtered to reduce false positives.
JWT Detection
EnvGuard now detects structurally valid JSON Web Tokens.
JWT detection validates:
Three-segment JWT structure
Base64URL-compatible segments
Valid JSON header
Standard JWT header fields
JWT values remain masked in output to maintain EnvGuard's privacy-first design.
Expanded Cloud & Platform Detection
v0.4.0 adds detection rules for additional cloud providers and developer platforms.
New coverage includes:
AWS Secret Access Keys
AWS Session Tokens
Google API Keys
Google Service Account indicators
Azure Storage Connection Strings
Azure Storage Keys
GitLab Tokens
npm Tokens
PyPI Tokens
Slack Tokens
Discord Tokens
All rules use stable rule IDs and integrate with EnvGuard's existing configuration and reporting system.
Context-Aware Detection
EnvGuard now understands more about the context surrounding a potential secret.
Credential-like variable names increase confidence, while known non-secret contexts such as:
SESSION_ID
BUILD_HASH
VERSION
CHECKSUM
COMMIT
TRACE_ID
REQUEST_ID
can reduce or suppress unnecessary findings.
Detection Signals
Findings can now include the signals that contributed to detection.
Examples include:
High entropy
Credential-like variable name
Long token-like value
Known secret pattern
Provider prefix
Valid JWT structure
Private key header
Non-placeholder value
This makes EnvGuard findings easier to understand and investigate.
Improved JSON Output
Structured JSON output now includes additional detection metadata such as:
detection_signals
entropy
provider
This improves integration with automation, scripts, and future CI/CD workflows.
False-Positive Protection
A major focus of v0.4.0 was avoiding noisy detections.
The advanced engine includes filtering for:
UUIDs
MD5 hashes
SHA-1 hashes
SHA-256 hashes
SHA-512 hashes
Git commit hashes
Checksums
Version strings
Build identifiers
Placeholder values
Known non-secret contexts
Privacy First
EnvGuard remains:
100% local
No cloud backend
No telemetry
No external API requests
No plaintext secrets in baselines
Masked secret output
Your project data stays on your machine.
Backward Compatibility
All existing EnvGuard commands continue to work:
envguard scan
envguard check
envguard diff
envguard status
envguard baseline
envguard init
envguard doctor
envguard rules list
envguard explain
envguard menu
envguard ui
Existing regex rules and configured severities are preserved.
The new advanced detection engine works with zero configuration by default while remaining configurable through .envguard.yml.
Upgrade
pip install --upgrade envguard
Verify the installation:
envguard --version
Expected:
EnvGuard version 0.4.0
What's Next?
v0.4.0 makes EnvGuard significantly smarter at detecting potential secrets.
The next major milestone, v0.5.0, will focus on bringing EnvGuard into real development workflows through:
CI/CD support
GitHub Actions
Pull Request scanning
SARIF reporting
Changed-file scanning
GitHub ecosystem integration
The Goal
Catch secrets before they enter Git history.
EnvGuard continues to focus on being lightweight, local, configurable, privacy-first, and developer-friendly.