v1.0.0 — Production Release: Local-First Secret Scanner & Safety Gate

EnvGuard v1.0.0 — Official Production Release 🛡️

We are thrilled to announce EnvGuard v1.0.0, our first official production release!

EnvGuard is a 100% local-first developer safety gate that catches secrets before they leave your machine, eliminates environment drift between .env and .env.example, provides automated safe remediation, and generates offline compliance audit evidence — with zero cloud dependencies, accounts, or telemetry.

---

🌟 What Makes EnvGuard Different?

• 100% Local & Privacy-Preserving: Runs entirely in local memory on your machine or CI runner. No code or credentials ever leave your system.
• Context-First Detection Pipeline: Entropy is treated as a supporting signal, not a standalone classifier. Normal identifiers, CSS styles, package names, MIME types, URLs, and mock fixtures never trigger false positives.
• Catch → Fix → Prove:
  1. Catch: Screen staged commits (check), pre-push branches (pre-push), directories (scan), or pull requests (ci).
  2. Fix: Safely extract hardcoded secrets into .env with automated .gitignore safety guards (fix --apply).
  3. Prove: Generate executive audit reports with offline SOC 2 Type II and ISO/IEC 27001:2022 control mappings (audit).

---

🚀 Key Highlights & Capabilities in v1.0.0

1. 16 Core CLI Commands

• Core Gates: init, scan, check, diff, ci
• Remediation: fix (AST-verified dry-runs and atomic .env extractions)
• Governance & Assurance: audit, baseline, status, lint-config
• Discovery & Diagnostics: rules, explain, doctor, watch
• Git Protocols: install-hook, pre-push

2. Context-First High-Entropy Redesign

• Completely re-engineered generic-high-entropy-secret rule into a semantic multi-signal pipeline requiring credential keywords or elevated symbol diversity.
• 0 False Positives verified on large-scale real-world production codebases.

3. Safe Automated Remediation (envguard fix)

• Replaces raw secrets with os.environ.get(...) references in Python code.
• Automatically creates or updates .gitignore to ensure .env is never committed to Git.
• Requires a clean Git tree (or explicit --allow-dirty) to protect against uncommitted work loss.
• Generated code is engineered to never re-trigger detection rules.

4. Enterprise Compliance & Configuration Assurance

• envguard lint-config: Strictly validates .envguard.yml and .envguard-org.yml for syntax errors, typos, unknown keys, and rule conflicts.
• envguard audit: Produces executive security grades (A+ to F), tracking legacy baseline debt separately from genuine code remediation, and exports print-ready standalone HTML / JSON reports.
• Compliance Cross-Referencing: Built-in offline mapping for SOC 2 Type II (CC6.1, CC6.6, CC6.7) and ISO/IEC 27001:2022 (A.5.15, A.8.12, A.8.24).

5. Developer & CI/CD Workflows

• Git Pre-Commit & Pre-Push Hooks: One-click install (envguard install-hook) preventing credential leaks before commits or pushes.
• Machine-Readable Outputs: Native --format json and --format sarif (SARIF 2.1.0) compatible with GitHub Code Scanning and IDEs.
• Predictable Exit Code Contract:
  • 0: Clean / Success / No blocking findings
  • 1: Blocking secrets detected / Policy violation / Environment drift
  • 2: CLI usage, configuration, or git cleanliness error
  • 3: Fatal system error

---

📦 Installation & Quick Start

Install via pip:

pip install envguard