EnvShield

Environment variables, as a version-controlled configuration contract.

~/projects/envshield $ envshield setup

EnvShield turns .env files into a real, committed contract — env.schema.toml — so a project declares what it actually needs. Everything else follows from that one file: validating a local .env against it, discovering variables the code reads that the schema doesn't know about, and reviewing how the contract itself changes across git revisions. Secret scanning is a supporting check, not the product's center of gravity.