EnvGuardian

EnvGuardian is a Node.js/TypeScript CLI tool for scanning .env files, Next.js/Vercel configs, and source code for secrets leakage and insecure practices.

Features

• Scans .env*, Next.js/Vercel configs, and source code for secret leaks
• Detects insecure patterns (e.g., NEXT_PUBLIC_*, hardcoded credentials, high-entropy keys)
• Flags dangerous Next.js middleware misconfigurations (CVE-2025-29927)
• Outputs results in CLI, JSON, and SARIF formats
• Supports custom ignore patterns via .secureenvignore
• Inline ignore support in code and .env files
• Severity filtering and summary reporting
• CI-friendly, open-source, no paid APIs

Installation

You can use EnvGuardian with npx (no install required):

npx envguardian scan

Or install locally:

npm install --save-dev envguardian

Usage

Basic Scan

npx envguardian scan

Output Formats

• Human-readable CLI (default)
• JSON: npx envguardian scan --json
• SARIF: npx envguardian scan --sarif (for GitHub code scanning)

Severity Filtering

npx envguardian scan --severity high

Summary Output

npx envguardian scan --summary

Ignore Patterns

Add files or folders to .secureenvignore (similar to .gitignore):

node_modules/
dist/
build/
.next/
.git/

Inline Ignore

Add # secureenv:ignore to a line in .env or // secureenv:ignore in code to skip that line.

Example GitHub Actions Workflow

jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Set up Node.js uses: actions/setup-node@v4 with: node-version: '20' - name: Install dependencies run: npm ci - name: Build run: npm run build - name: Run SecureEnv scan run: node dist/cli.js scan --sarif > results.sarif

name: EnvGuardian Scan
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Install dependencies
        run: npm ci
      - name: Build
        run: npm run build
      - name: Run EnvGuardian scan
        run: npx envguardian scan --sarif > results.sarif

Configuration

• .secureenvignore: List of files/folders to exclude from scanning
• CLI options: --json, --sarif, --severity, --summary

Contributing

Contributions are welcome. Please open issues or pull requests for bug reports, feature requests, or improvements.

License

MIT