env-audit-cli

A fast, CI-friendly CLI tool that audits .env files for exposed secrets and security issues.

Features

• 🔑 Detects AWS keys, GitHub tokens, Stripe keys, Slack tokens, SendGrid, Twilio, JWT secrets, database URLs with passwords, and more
• 🚦 Severity levels: critical, warning, info
• 🔒 Checks whether .env files are listed in .gitignore
• 💡 Suggests actionable fixes for every issue
• 📄 Supports multiple env files (.env, .env.local, .env.production, etc.)
• 🖥️ Color-coded human-readable output
• 📋 --json flag for machine-readable output
• ❌ Exits with code 1 when critical issues are found (CI-friendly)

Installation

npm install -g env-audit-cli
# or run without installing
npx env-audit-cli

Usage

# Scan default env files (.env, .env.local, .env.production, .env.development, .env.staging)
env-audit-cli

# Scan specific files
env-audit-cli .env .env.production

# JSON output (for CI pipelines / jq processing)
env-audit-cli --json

# Disable color (useful in CI logs)
env-audit-cli --no-color

Example Output

🔍 env-audit-cli — Security Audit

📄 .env
  ✔ Found in .gitignore
  ✖ [CRITICAL] line 4 — AWS Access Key ID detected
     Key:   AWS_ACCESS_KEY_ID
     Value: AKIA****
     Fix:   Rotate this AWS key immediately. Use IAM roles or secrets managers.

  ⚠ [WARNING] line 7 — JWT secret with weak or exposed value
     Key:   JWT_SECRET
     Value: mysec****
     Fix:   Ensure the JWT secret is at least 256 bits (32 random bytes). Rotate and store securely.

──────────────────────────────────────────────────
Summary
  ✖ Critical: 1  ⚠ Warnings: 1  ℹ Info: 0
  Total issues: 2

❌ Critical issues found — exiting with code 1

Rules

| Rule ID | Description | Severity | |---|---|---| | aws-access-key | AWS Access Key ID | critical | | aws-secret-key | AWS Secret Access Key | critical | | github-token | GitHub PAT / OAuth token | critical | | private-key-pem | PEM private key block | critical | | database-url-with-password | DB URL with embedded password | critical | | slack-token | Slack API token | critical | | stripe-key | Stripe secret key | critical | | sendgrid-key | SendGrid API key | critical | | twilio-key | Twilio Account SID / Auth Token | critical | | generic-api-key | Generic API key with real-looking value | warning | | jwt-secret | JWT secret | warning | | postgres-password | PostgreSQL password variable | warning | | mysql-password | MySQL password variable | warning | | generic-password | Generic password variable | warning | | placeholder-not-set | Value is an obvious placeholder | info | | empty-secret | Secret variable has an empty value | info |

Exit Codes

| Code | Meaning | |---|---| | 0 | No issues, or only warnings/info | | 1 | One or more critical issues found |

CI Integration

# GitHub Actions example
- name: Audit .env files
  run: npx env-audit-cli --no-color

# Pre-commit hook
env-audit-cli .env || exit 1

License

MIT