🛡️ env-sentry

Stop leaking secrets in .env files. Zero dependencies, one command.

Every project with a .env file eventually has one of these moments:

• Someone's .env isn't in .gitignore and real secrets get pushed to GitHub.
• .env.example drifts out of sync, and a new teammate spends 20 minutes figuring out which env vars they're missing.
• A Stripe key or AWS credential gets hardcoded "just for testing" and never gets cleaned up.

env-sentry is a tiny CLI that catches all three, in one command, with no dependencies to install.

Install

pip install env-sentry

Quick start

# Scaffold .env.example and make sure .env is git-ignored
env-sentry init

# Compare .env against .env.example, flag drift and leaked secrets
env-sentry check

# Regenerate .env.example from .env (values are redacted, never copied)
env-sentry sync

# Scan the whole repo for hardcoded API keys, tokens, and private keys
env-sentry scan

Example output

$ env-sentry check

❌ Keys in .env but missing from .env.example:
   - STRIPE_SECRET_KEY
   - DATABASE_URL

🚨 .env.example may contain REAL secret values, not placeholders:
   - OLD_API_KEY

🚨 '.env' does not appear to be listed in .gitignore!
   Anyone who commits will leak real secrets. Run `env-sentry init` to fix this.

$ env-sentry scan

config.py:14  AWS Access Key
config.py:14  Suspicious value for 'AWS_SECRET'
notes.txt:3   GitHub Token

🚨 3 potential secret(s) found. Review before committing/pushing.

What it checks for

Exit codes are non-zero on any issue found, so it's a one-line addition to CI or a pre-commit hook:

# .github/workflows/tests.yml
- run: pip install env-sentry && env-sentry check && env-sentry scan

# pre-commit hook
env-sentry scan || exit 1

Why not just use git-secrets / truffleHog / detect-secrets?

Those are great, heavier tools for deep git-history scanning. env-sentry is intentionally small: it's the 5-second daily check, not a security audit platform. No config file, no dependencies, no setup — just an honest answer to "did I mess up my .env today?"

Contributing

Issues and PRs welcome. The whole tool is a single ~250 line file (env_sentry/cli.py) on purpose — keep it that way.

License

MIT