envdead

A language-agnostic CLI that audits environment variables across your entire codebase.

One scan catches three classes of problems:

| Class | Meaning | Risk | |---|---|---| | Missing | Used in code, absent from .env.example | New contributors can't run the app | | Undocumented | In .env but not in .env.example | Secret forgotten in docs | | Dead | In .env.example but never used in code | Stale noise, confuses contributors |

Existing tools (envscan, spotenv) only cover Node.js and only generate .env.example.
envdead works across 9 languages, runs on Windows/Mac/Linux, needs zero dependencies, and detects dead vars too.

Install

npm install -g envdead

Or run without installing:

npx envdead

Usage

# Audit the current directory
envdead

# Audit a specific project
envdead ./my-project

# CI mode — exit 1 if any missing or undocumented vars found
envdead --strict

# Auto-add missing vars to .env.example
envdead --fix

Example Output

envdead — Environment Variable Audit
Scanned 47 files · 12 env var(s) found in code

⚠  MISSING (2) — used in code but absent from .env.example:
   DATABASE_URL                     src/db.js:14  src/db.js:28
   STRIPE_SECRET_KEY                src/payments.js:5

✘  UNDOCUMENTED (1) — in .env but not in .env.example:
   OLD_LEGACY_KEY

☠  DEAD (2) — in .env.example but never referenced in code:
   UNUSED_WEBHOOK_URL
   LEGACY_FEATURE_FLAG

✓  OK: 8 variable(s) documented and used.

Tip: run `envdead --fix` to auto-add missing vars to .env.example

Supported Languages

| Language | Pattern detected | |---|---| | JavaScript / TypeScript | process.env.VARIABLE | | Python | os.environ['VAR'], os.getenv('VAR') | | Ruby | ENV['VAR'], ENV.fetch('VAR') | | PHP | $_ENV['VAR'], getenv('VAR') | | Go | os.Getenv("VAR") | | Rust | env::var("VAR") | | Shell | ${VAR_NAME} | | YAML | ${VAR_NAME}, $VAR_NAME | | Dockerfile | ${VAR_NAME} |

CI Integration

# .github/workflows/env-audit.yml
name: Env Audit
on: [push, pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npx envdead --strict

How It Works

1. Walks your directory tree (skips node_modules, .git, dist, build, etc.)
2. For each file, applies the language-appropriate regex to extract env var names
3. Parses your .env and .env.example files for defined keys
4. Compares the three sets and reports the diff

No network requests. No config needed. Zero dependencies.

Contributing

git clone https://github.com/Rushabh5000/envdead
cd envdead
node bin/envdead.js --help

PRs welcome — especially for new language patterns.

License

MIT

Keywords

env vars · dotenv · .env audit · unused env vars · missing env vars · env linter · environment variables · env checker · ci · zero dependencies · cross-platform · nodejs cli

Built to solve, shared to help — Rushabh Shah 🛠️✨

One of 40+ zero-dependency developer CLI tools — no node_modules, ever.