envspect — Zero-Config .env & Secret Audit CLI
High-performance CLI tool for automated .env file validation and credential leak detection. Compares environment files and audits codebases for 15+ sensitive credential patterns before production deployments.
Executive Summary
The Challenge
Outdated .env.example files leading to onboarding friction and accidental credential leaks in production codebases.
The Solution
Ultra-light (<30kB) pure ESM CLI with custom lexical env parser, diffing engine, and 15+ regex heuristic scanners with zero runtime bloat.
Measurable Impact
Instant npx execution (<1s), automated CI/CD pipeline quality gates, and 15+ secret leak patterns detected with automatic redaction.
Technologies
Key Decisions
Why zero-bloat over large CLI frameworks?
Developer tools running via 'npx' must execute instantly. Keeping total unpacked size under 30kB guarantees sub-second execution without network lag.
Why custom lexical parsing instead of dotenv?
Existing parsers discard line numbers and comments. envspect needed exact line mappings to output beautiful terminal diff tables.
Why automated secret masking?
Terminal outputs must never expose full credentials in CI logs or terminal recordings. Redacting matched tokens ensures zero secondary leak risk.
Retrospective
Hardest Part
Handling edge cases in multiline quoted strings and inline comments across varying OS line endings (CRLF vs LF).
Biggest Insight
Building developer tools demands strict attention to exit codes, bundle size, and developer ergonomics.
Do Differently
I plan to implement the team sync command using asymmetric public-key cryptography for encrypted team sharing.
Key Highlights
Zero-Config Env Diffing
Compares .env with .env.example to immediately flag missing, extra, and empty variables.
15+ Secret Leak Detection Rules
Catches leaked AWS, Stripe, GitHub, database URLs, and private keys with automated masking.
CI/CD & Pipeline Integration
Provides strict error exit codes and JSON output for automated pull request checks.
Dual CLI & Programmatic API
Ships with complete TypeScript definitions so developers can import diff and scanner functions.
Open to opportunities