envdead

A language-agnostic CLI that audits environment variables across your entire codebase.

One scan catches three classes of problems:

Class	Meaning	Risk
Missing	Used in code, absent from .env.example	New contributors can't run the app
Undocumented	In .env but not in .env.example	Secret forgotten in docs
Dead	In .env.example but never used in code	Stale noise, confuses contributors

Existing tools (envscan, spotenv) only cover Node.js and only generate .env.example.
envdead works across 9 languages, runs on Windows/Mac/Linux, needs zero dependencies, and detects dead vars too.

---

Install

npm install -g envdead

Or run without installing:

npx envdead

---

Usage

# Audit the current directory
envdead

# Audit a specific project
envdead ./my-project

# CI mode — exit 1 if any missing or undocumented vars found
envdead --strict

# Auto-add missing vars to .env.example
envdead --fix

---

Example Output

envdead — Environment Variable Audit
Scanned 47 files · 12 env var(s) found in code

⚠  MISSING (2) — used in code but absent from .env.example:
   DATABASE_URL                     src/db.js:14  src/db.js:28
   STRIPE_SECRET_KEY                src/payments.js:5

✘  UNDOCUMENTED (1) — in .env but not in .env.example:
   OLD_LEGACY_KEY

☠  DEAD (2) — in .env.example but never referenced in code:
   UNUSED_WEBHOOK_URL
   LEGACY_FEATURE_FLAG

✓  OK: 8 variable(s) documented and used.

Tip: run `envdead --fix` to auto-add missing vars to .env.example

---

Supported Languages

Language	Pattern detected
JavaScript / TypeScript	process.env.VARIABLE
Python	os.environ['VAR'], os.getenv('VAR')
Ruby	ENV['VAR'], ENV.fetch('VAR')
PHP	$_ENV['VAR'], getenv('VAR')
Go	os.Getenv("VAR")
Rust	env::var("VAR")
Shell	${VAR_NAME}
YAML	${VAR_NAME}, $VAR_NAME
Dockerfile	${VAR_NAME}

---

CI Integration

# .github/workflows/env-audit.yml
name: Env Audit
on: [push, pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npx envdead --strict

---

How It Works

1. Walks your directory tree (skips node_modules, .git, dist, build, etc.)
2. For each file, applies the language-appropriate regex to extract env var names
3. Parses your .env and .env.example files for defined keys
4. Compares the three sets and reports the diff

No network requests. No config needed. Zero dependencies.

---

Contributing

git clone https://github.com/Rushabh5000/envdead
cd envdead
node bin/envdead.js --help

PRs welcome — especially for new language patterns.

---

License

MIT

---

Keywords

env vars · dotenv · .env audit · unused env vars · missing env vars · env linter · environment variables · env checker · ci · zero dependencies · cross-platform · nodejs cli

---

Built to solve, shared to help — Rushabh Shah 🛠️✨

_{One of 40+ zero-dependency developer CLI tools — no node_modules, ever.}