Map every environment-variable source under a folder. Finds .env, .env.local, .env., templates (.env.example/.sample/.template), docker-compose environment:/env_file:, and CI workflow env: blocks; groups them by env root (a monorepo has several) and reports variable counts, duplicates, syntax problems, BOM/CRLF, and which framework client prefixes (VITE_, NEXT_PUBLIC_, ...) are in use. Never shows values. Start here.

path: folder to scan, relative to the server's --dir sandbox (default: the whole sandbox).

Compare .env with its template (.env.example/.sample/.template) in every env root. Reports names missing from .env, extra names the template does not document, variables empty in .env but required by the template (a # optional comment above a template line exempts it), duplicated names, and values whose type differs from the template's. Commented-out template lines (# NAME=) count as documented.

path: folder to scan. file / against: compare two specific env files instead (paths relative to path), for example file=".env.production", against=".env.example".

Scan source code for environment reads and cross-check them with the templates. Understands process.env.X / process.env["X"] / destructuring, import.meta.env.X, Deno.env.get, os.environ[...] / os.environ.get / os.getenv, ENV['X'] / ENV.fetch, std::env::var / env!, os.Getenv / os.LookupEnv, System.getenv, Environment.GetEnvironmentVariable, getenv / $ENV / Laravel env(), System.get_env, Prisma env(), and ${X} in compose files. Reports variables used in code but undocumented in the template (with file:line), documented but never read, and client-exposed secret-looking names. Ambient variables (PATH, HOME, NODE_ENV, GITHUB*) are ignored. It is a text scan: reads inside comments count, dynamic names (process.env[name]) are invisible.

path: folder to scan, relative to the sandbox.

Check env files for mistakes, from names and shapes only (no value is ever printed). Flags: placeholders (changeme, your_key_here), empty values, trailing whitespace, unquoted spaces, CRLF, a BOM, values wrapped in literal quotes, undefined ${REF}s, duplicates, syntax errors; names that promise a type but disagree (*URL not a URL, *PORT out of range, booleans, integers, emails, JWTs, *PATH that does not exist); localhost URLs in production files; real-looking secrets inside a template; and secret-looking names with a browser-exposed prefix (VITE, NEXT_PUBLIC, REACT_APP, ...).

path: folder to scan. file: validate only this env file (relative to path).

Is each real env file safe from git? For every .env/.env.* file (templates excluded) says whether it is ignored, tracked, or present in any commit on any branch, and lists env files that were committed once and deleted (still in history). Uses git check-ignore, git ls-files and git log --all by file name only: no content is read, no history is rewritten. Also flags a template that is itself ignored. Requires git on PATH.

path: folder inside the repository to check.

Propose a safe .env.example as text (one section per env root). It lists every variable seen in env files, templates and source code, each with a type hint, whether it looks secret, where the code reads it, and a warning if a secret would be exposed to the browser. Every line is NAME= with nothing after the equals sign: no value, not even from your templates. Nothing is written to disk; paste or save the text yourself.

path: folder to scan.