env-sentry CLI
Install env-sentry

Open-source .env security CLI

Stop leaking secrets in .env files.

A tiny, zero-dependency CLI that catches exposed secrets, keeps .env.example in sync, and scans your repository for hardcoded keys.

Install env-sentry View on GitHub (opens in new tab)
  • MIT licensed
  • Python 3.8+
  • v0.1.4

Quick start

From install to first check in three commands.

No dependencies to assemble. No config file to learn. Start with the defaults and get a useful answer immediately.

  1. Install the CLI

    pip install env-sentry

  2. Scaffold the safety net

    env-sentry init

  3. Run the first audit

    env-sentry check

Requires Python 3.8+. Command not found? Fix your PATH (opens in new tab).

Why env-sentry

The mistakes that slip into an ordinary commit.

Small oversights become public incidents. env-sentry checks for them while the fix is still local and easy.

  • Real secrets in git

    API keys, tokens, and private keys can slip into a commit before anyone notices.

  • Example-file drift

    .env.example falls behind .env, leaving teammates to guess which variables they need.

  • Hardcoded credentials

    Temporary Stripe keys, AWS credentials, and tokens become permanent when they reach git.

  • Missing ignore rules

    One absent .env entry in .gitignore can expose every value in the file.

Command reference

Four commands. No config file.

Each command does one clear job, so you can use the whole safety net or only the check you need.

env-sentry init

Creates .env.example if needed and adds .env to .gitignore.

env-sentry check

Compares both files, flags exposed values, and verifies that .env is ignored.

env-sentry sync

Rebuilds .env.example with placeholders. Real values are never copied.

env-sentry scan

Searches for AWS keys, tokens, private keys, JWTs, and suspicious assignments.

Automation-ready: any issue returns a non-zero exit code, so the same commands work in CI and pre-commit hooks.

Example output

See exactly what needs fixing.

Real example output from the project README: specific files, variable names, and a useful next step.

env-sentry check Example output 
$ env-sentry check

❌ Keys in .env but missing from .env.example:
   - STRIPE_SECRET_KEY
   - DATABASE_URL

🚨 .env.example may contain REAL secret values, not placeholders:
   - OLD_API_KEY

🚨 '.env' does not appear to be listed in .gitignore!
   Anyone who commits will leak real secrets. Run `env-sentry init` to fix this.
env-sentry scan Example output 
$ env-sentry scan

config.py:14  AWS Access Key
config.py:14  Suspicious value for 'AWS_SECRET'
notes.txt:3   GitHub Token

🚨 3 potential secret(s) found. Review before committing/pushing.

Automation

Catch the leak before the push.

Run the same check on every pull request, or stop a risky commit before it leaves your machine.

Read CI and pre-commit setup (opens in new tab) 
# .github/workflows/tests.yml
- run: pip install env-sentry && env-sentry check && env-sentry scan

# pre-commit hook
env-sentry scan || exit 1

Choose your scope

A daily check, not a heavyweight audit.

Pick the tool that matches the job. env-sentry focuses on the environment-file mistakes developers make every day.

Comparison of env-sentry and other secret-scanning tools by intended use and setup
Tool Best for Setup
env-sentry Daily .env checks and working-tree secret scans No config file
git-secrets Preventing known secret patterns from entering commits Patterns and hooks
truffleHog Broad secret discovery, including git history Scan options
detect-secrets Secret scanning with an explicit baseline Baseline file

Dedicated scanners are better suited to deep history audits. env-sentry stays small: no dependencies, no config, and a clear answer before your next commit.

Your next commit

Make the safe commit the easy commit.

Install the CLI, run one check, and fix issues while they are still local.

pip install env-sentry
Star env-sentry on GitHub (opens in new tab)