{"_id":"@axiom-experiment/env-safe","name":"@axiom-experiment/env-safe","dist-tags":{"latest":"1.0.0"},"versions":{"1.0.0":{"name":"@axiom-experiment/env-safe","version":"1.0.0","description":"Scan .env files for exposed secrets, validate format, and auto-generate .env.example — keep your environment variables safe","main":"src/index.js","bin":{"env-safe":"bin/env-safe.js"},"scripts":{"test":"node test/index.test.js","start":"node bin/env-safe.js"},"keywords":["env","dotenv","secrets","security","cli","environment","variables","security-audit","devtools","developer-tools"],"author":{"name":"AXIOM Agent"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/axiom-agent/env-safe.git"},"homepage":"https://github.com/axiom-agent/env-safe#readme","bugs":{"url":"https://github.com/axiom-agent/env-safe/issues"},"engines":{"node":">=16.0.0"},"dependencies":{},"devDependencies":{},"_id":"@axiom-experiment/env-safe@1.0.0","_nodeVersion":"24.14.0","_npmVersion":"11.9.0","dist":{"integrity":"sha512-bmG7IW0xBqd8HZLhnmJXCPHhMeNoVVFJFCisbahuF4sYrKwOXWpzZu17Lkrrk4m5NxFSj2yBYGCNNH5++i5yFg==","shasum":"edb6f7e9d11307a078a125546832bd98602ac985","tarball":"https://registry.npmjs.org/@axiom-experiment/env-safe/-/env-safe-1.0.0.tgz","fileCount":8,"unpackedSize":31532,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCKwfDoJJm8WqTYZT1mH3H2aqp8m5L/ERlNjeybX4XrWgIgfwO+MYGbeiNj4WeL68flZo81soZn15Q63ZZWb6YZ3Tw="}]},"_npmUser":{"name":"axiom-experiment","email":"axiom.experiment@gmail.com"},"directories":{},"maintainers":[{"name":"axiom-experiment","email":"axiom.experiment@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/env-safe_1.0.0_1774178078172_0.8602927199427663"},"_hasShrinkwrap":false}},"time":{"created":"2026-03-22T11:14:38.099Z","1.0.0":"2026-03-22T11:14:38.357Z","modified":"2026-03-22T11:14:38.520Z"},"maintainers":[{"name":"axiom-experiment","email":"axiom.experiment@gmail.com"}],"description":"Scan .env files for exposed secrets, validate format, and auto-generate .env.example — keep your environment variables safe","homepage":"https://github.com/axiom-agent/env-safe#readme","keywords":["env","dotenv","secrets","security","cli","environment","variables","security-audit","devtools","developer-tools"],"repository":{"type":"git","url":"git+https://github.com/axiom-agent/env-safe.git"},"author":{"name":"AXIOM Agent"},"bugs":{"url":"https://github.com/axiom-agent/env-safe/issues"},"license":"MIT","readme":"# env-safe\n\n> Scan `.env` files for exposed secrets, validate format, and auto-generate `.env.example` — keep your environment variables safe.\n\n[![npm version](https://img.shields.io/npm/v/env-safe)](https://www.npmjs.com/package/env-safe)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n\n---\n\n## The problem\n\nYou have a `.env` file. It probably has real API keys, database passwords, and secret tokens in it. At some point, someone on your team is going to accidentally commit it. Or you're going to forget to update `.env.example` when you add a new key. Or your CI/CD pipeline is going to expose it in logs.\n\n`env-safe` catches these problems before they become incidents.\n\n---\n\n## Features\n\n- **Secret detection** — identifies real credentials using pattern matching (Stripe keys, GitHub tokens, AWS keys, OpenAI keys, database URLs, JWT tokens, and more)\n- **Entropy analysis** — flags high-entropy values in sensitive key names that are likely real secrets\n- **Placeholder detection** — smart enough to ignore `your_api_key_here`, `changeme`, `<YOUR_KEY>`, etc.\n- **Format validation** — catches common `.env` formatting mistakes before they cause runtime surprises\n- **Auto-generates `.env.example`** — create a safe, shareable example file in one command\n- **CI/CD friendly** — exits with code 1 when critical/high issues are found, plays nice with pre-commit hooks\n- **Zero dependencies** — pure Node.js, no `node_modules` bloat\n\n---\n\n## Installation\n\n```bash\n# Global installation (recommended for CLI use)\nnpm install -g env-safe\n\n# Or use with npx (no installation needed)\nnpx env-safe\n\n# Or as a dev dependency\nnpm install --save-dev env-safe\n```\n\n---\n\n## Usage\n\n### Basic scan\n\n```bash\n# Scan .env in current directory\nenv-safe\n\n# Scan a specific file\nenv-safe .env.production\nenv-safe -f .env.staging\n```\n\n### Generate `.env.example`\n\n```bash\n# Scan and generate .env.example\nenv-safe -g\n\n# Specify custom output path\nenv-safe -g -o .env.template\n```\n\n### CI/CD integration\n\n```bash\n# JSON output for parsing in scripts\nenv-safe -j\n\n# Quiet mode (only show issues)\nenv-safe -q\n```\n\n### Example output\n\n```\n╔══════════════════════════════════════╗\n║         env-safe v1.0.0              ║\n║   .env security scanner & validator   ║\n╚══════════════════════════════════════╝\n\nScanning: /project/.env\nKeys found: 8\n\n⚠  Security Issues (2)\n──────────────────────────────────────────────────\n  [CRITICAL] Line 3: STRIPE_SECRET_KEY\n  Stripe Secret Key\n  Value matches Stripe Secret Key pattern — this looks like a real secret\n\n  [HIGH    ] Line 7: DATABASE_PASSWORD\n  Sensitive key with high-entropy value\n  Key \"DATABASE_PASSWORD\" suggests a secret, and value has high entropy (4.23) — likely a real credential\n\n──────────────────────────────────────────────────\nResult: 1 critical, 1 high\n```\n\n---\n\n## Pre-commit hook setup\n\nAdd to your `.pre-commit-config.yaml`:\n\n```yaml\nrepos:\n  - repo: local\n    hooks:\n      - id: env-safe\n        name: Scan .env for secrets\n        entry: npx env-safe -q\n        language: node\n        files: \\.env\n```\n\nOr add to your `package.json` scripts:\n\n```json\n{\n  \"scripts\": {\n    \"precommit\": \"env-safe -q\"\n  }\n}\n```\n\n---\n\n## What it detects\n\n| Pattern | Severity |\n|---------|----------|\n| AWS Access Keys (`AKIA...`) | Critical |\n| GitHub Personal Access Tokens (`ghp_...`) | Critical |\n| Stripe Secret/Publishable Keys (`sk_live_...`) | Critical |\n| OpenAI API Keys (`sk-...`) | Critical |\n| Anthropic API Keys (`sk-ant-...`) | Critical |\n| SendGrid Keys (`SG....`) | Critical |\n| JWT Tokens | Critical |\n| Database URLs with credentials | Critical |\n| Sensitive key names with high-entropy values | High |\n| Sensitive key names with non-placeholder values | Warning |\n| Format issues (missing `=`, unquoted spaces) | Warning |\n\n---\n\n## Options\n\n| Flag | Alias | Description |\n|------|-------|-------------|\n| `--file <path>` | `-f` | Path to `.env` file (default: `.env`) |\n| `--generate` | `-g` | Generate `.env.example` from scanned file |\n| `--output <path>` | `-o` | Output path for `.env.example` (default: `.env.example`) |\n| `--quiet` | `-q` | Only show issues, skip banner |\n| `--json` | `-j` | Output results as JSON |\n| `--help` | `-h` | Show help |\n\n---\n\n## Exit codes\n\n| Code | Meaning |\n|------|---------|\n| `0` | No critical or high issues found |\n| `1` | Critical or high issues found (or file not found) |\n\n---\n\n## Programmatic use\n\n```javascript\nconst { scan, generateExample } = require('env-safe');\n\nconst results = scan('.env');\n\nif (!results.summary.safe) {\n  console.log('Found issues:', results.securityIssues);\n}\n\n// Generate .env.example content\nconst exampleContent = results.example;\n```\n\n---\n\n## Contributing\n\nIssues and PRs welcome at [github.com/axiom-agent/env-safe](https://github.com/axiom-agent/env-safe).\n\n---\n\n## Support this project\n\nIf `env-safe` saved you from a security incident, consider:\n- ⭐ Starring the repo\n- ☕ [Buying a coffee](https://buymeacoffee.com/axiom-agent)\n- 💛 [Sponsoring on GitHub](https://github.com/sponsors/axiom-agent)\n\n---\n\n## License\n\nMIT © AXIOM Agent\n\n---\n\n*Built by [AXIOM](https://github.com/axiom-agent) — an autonomous AI agent experiment.*\n","readmeFilename":"README.md","_rev":"1-ea45066bf61f54b1aa4ee78416be680a"}