.env Sanitizer & Secret Scanner

1Committing .env instead of .env.example

✗ Wrong: Adding the real .env file to git because the project worked without a .gitignore

✓ Fix: Always add .env* to .gitignore before the first commit. Commit only .env.example with placeholder values.

2Logging env vars for debugging

✗ Wrong: console.log(process.env) to check why a variable is undefined — which logs all secrets to your CI output

✓ Fix: Log only the specific variable you're checking: console.log('STRIPE_KEY defined:', !!process.env.STRIPE_SECRET_KEY). Never log the value.

3Hardcoding secrets as fallbacks

✗ Wrong: const key = process.env.API_KEY ?? 'sk_live_realkey' — so the app 'works' even without .env

✓ Fix: Throw at startup if a required secret is missing: if (!process.env.API_KEY) throw new Error('API_KEY is required'). Fail loudly, never silently use a hardcoded default.

4Storing secrets in NEXT_PUBLIC_ variables

✗ Wrong: NEXT_PUBLIC_STRIPE_SECRET_KEY=sk_live_... — which embeds the secret in the client bundle

✓ Fix: NEXT_PUBLIC_ variables are exposed to the browser. Only use them for public config (app URL, analytics ID). Server-only secrets must never have this prefix.

5Sharing .env over Slack or email

✗ Wrong: Pasting the full .env into a DM or email to onboard a new developer

✓ Fix: Use a secrets manager with per-person access (Doppler, 1Password Teams, AWS Secrets Manager). Each developer pulls their own credentials with proper audit logging.

// npm install dotenv
import "dotenv/config"

// Or with explicit path:
import { config } from "dotenv"
config({ path: ".env.local" })

// Validate required vars at startup:
const required = ["DATABASE_URL", "STRIPE_SECRET_KEY", "JWT_SECRET"]
for (const key of required) {
  if (!process.env[key]) throw new Error(`Missing env var: ${key}`)
}

// .env.local (never committed)
DATABASE_URL=postgresql://...
STRIPE_SECRET_KEY=sk_live_...
NEXT_PUBLIC_APP_URL=https://myapp.com  // browser-safe only

// In server code (app/api/route.ts, server actions):
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!)

// In client code — only NEXT_PUBLIC_ vars are available:
const appUrl = process.env.NEXT_PUBLIC_APP_URL

# pip install python-dotenv
from dotenv import load_dotenv
import os

load_dotenv()  # loads .env from current directory

# Validate required secrets:
required = ["DATABASE_URL", "STRIPE_SECRET_KEY"]
missing = [k for k in required if not os.getenv(k)]
if missing:
    raise EnvironmentError(f"Missing env vars: {', '.join(missing)}")

stripe_key = os.environ["STRIPE_SECRET_KEY"]

# Install git-secrets: https://github.com/awslabs/git-secrets
brew install git-secrets  # macOS
git secrets --install     # hooks into pre-commit

# Or use trufflehog for history scanning:
# pip install trufflehog
trufflehog git file://. --only-verified

# One-liner: scan working tree for common patterns:
grep -rE "(sk_live|sk_test|ghp_|AKIA[0-9A-Z]{16})" .   --include="*.env" --include="*.json" --include="*.ts"