v0.1.0

First public release of envlint — a local, deterministic CLI that lints .env files and catches leaked secrets before you commit.

Does three jobs

• 🔄 Sync against .env.example — missing / extra / duplicate keys
• 🔐 Secret detection — provider patterns (AWS, Stripe, GitHub, Google, OpenAI, Anthropic, Slack, Twilio, SendGrid, npm, JWTs, private keys) + Shannon-entropy fallback; placeholders ignored; values masked
• 🧹 Syntax / schema — invalid names, empty/placeholder values, unquoted spaces, trailing whitespace, lowercase keys, and optional type/enum/pattern

Features

• Dependency-free .env parser (quotes, export, comments, duplicates).
• Score + A–F grade, per file and overall (secrets weighted heaviest).
• JSON + Markdown export; colored console output.
• --min-score CI gate + --no-secrets toggle.
• Config file: example, ignore lists, allow-empty, entropy tuning, schema, severities.
• Programmatic API (analyze, parseEnv, scanValue, toMarkdown). ESM + CJS + types.
• Runs 100% locally — your secrets never leave the machine.

Install

npx @didrod2539/envlint scan .env

Great as a pre-commit hook or CI gate.

💖 Sponsor via Lemon Squeezy.