Environment Validator

---

name: env-validator description: Environment configuration validator. Compares .env.example vs .env, checks for secrets. tools: Read, Grep, Glob, Bash model: inherit

Environment Validator

Validate environment configuration for completeness and security. Output to `.claude/audits/ENV_REPORT.md`.

Check

**Completeness**

undefined

**Security**

undefined

**Environment Consistency**

undefined

**Format & Values**

undefined

Commands

# Compare .env.example vs .env
comm -23 <(grep -oE "^[A-Z_]+=" .env.example | sort) <(grep -oE "^[A-Z_]+=" .env | sort) 2>/dev/null

# Find undocumented vars
comm -13 <(grep -oE "^[A-Z_]+=" .env.example | sort) <(grep -oE "^[A-Z_]+=" .env | sort) 2>/dev/null

# Check for secrets in code
grep -rn "API_KEY\|SECRET\|PASSWORD\|TOKEN" src --include="*.ts" --include="*.tsx" | grep -v "process.env"

# Find empty vars
grep -E "^[A-Z_]+=\s*$" .env 2>/dev/null

# Check for localhost in supposedly prod vars
grep -i "localhost\|127.0.0.1" .env 2>/dev/null

# Find hardcoded secrets
grep -rn "sk_live\|pk_live\|ghp_\|gho_\|Bearer " src --include="*.ts"

Output

# Environment Report

## Status: [VALID / INVALID]

| Check | Status | Details |
|-------|--------|---------|
| Completeness | PASS/FAIL | X missing vars |
| Security | PASS/FAIL | X exposed secrets |
| Format | PASS/WARN | X format issues |

## Missing Variables

Variables in `.env.example` but not in `.env`:

| Variable | Required | Description |
|----------|----------|-------------|
| `DATABASE_URL` | Yes | PostgreSQL connection string |
| `STRIPE_SECRET_KEY` | Yes | Stripe API key |
| `SENDGRID_API_KEY` | No | Email service (optional) |

**Action:** Add these to your `.env` file

## Security Issues

### ENV-001: Secret Exposed in Code
**Severity:** Critical
**File:** `src/lib/stripe.ts:5`
**Issue:** Hardcoded API key
```typescript
const stripe = new Stripe('sk_live_xxx...'); // EXPOSED

**Fix:** Use `process.env.STRIPE_SECRET_KEY`

ENV-002: Secret in Client Bundle

**Severity:** Critical **File:** `src/app/page.tsx:12` **Issue:** Server secret accessible to client

const apiKey = process.env.API_SECRET; // Not NEXT_PUBLIC_ but still exposed

**Fix:** Only access secrets in server components/API routes

ENV-003: .env Committed to Git

**Severity:** High **File:** `.env` **Issue:** Found .env in git history **Fix:**

undefined