Never ship missing, broken, or weak .env secrets to production.
dotvet is a command-line tool that scans your codebase, finds every environment variable your application needs, checks that your .env has real, safe values (no "changeme", no dummy passwords, no short JWT secrets), and stops your build if anything is insecure.
Why Do You Need This?
The difference between standard tools and dotvet in 10 seconds:
What existing tools (like dotenv-safe) do:
“All variables exist! Build passed! ✅”
The Reality: Existing tools only check if a variable exists. They don't care if it's garbage. Your app deploys with JWT_SECRET="secret", allowing hackers to forge admin logins in seconds.
What dotvet does:
It audits the actual security quality of your values. It catches placeholder strings, enforces cryptographic strength on tokens, blocks broken pull requests, and can automatically repair them.
How dotvet Compares
Why existing linters like dotenv-safe leave your production apps vulnerable:
| Capability | dotvet 🛡️ | dotenv-safe | dotenvx | gitleaks / trufflehog |
|---|---|---|---|---|
| Code-aware Scanning (auto-derives required vars from code) | ✅ Zero-config | ❌ (Manual .env.example) | ❌ | ❌ |
Bans Dummy Placeholders (changeme, dummy, test) |
✅ Yes | ❌ (Passes them) | ❌ | ❌ |
| Enforces JWT Minimum Strength (≥ 32 chars / 256-bit) | ✅ Hard Fail | ❌ | ❌ | ❌ |
Entropy & Repeating Pattern Detector (abcdefgh*4) |
✅ Yes | ❌ | ❌ | ✅ (Git commits only) |
Auto-Heals Secrets & .gitignore (dotvet fix) |
✅ Yes | ❌ | ❌ | ❌ |
Generates Team Env Contract (.env.schema.json) |
✅ Yes | ❌ | ❌ | ❌ |
Native GitHub Action (uses: EthicCodeTech/dotvet@main) |
✅ Yes | ❌ | ⚠️ | ⚠️ |
| Runtime Dependencies | 0 (Safe) | Multiple | Multiple | Go Binary |
How It Works
Zero configuration required. It inspects your real code and env files.
Auto-Scans Your Code
It looks through your JS, TS, Python, Go, and Docker files to find every environment variable your code calls (process.env.VAR or os.getenv('VAR')). You don't have to manually write schemas.
Audits Security Quality
It compares your code's needs against your .env file. Are any required vars missing? Are values dummy placeholders? Is your JWT secret under 32 characters?
Protects & Auto-Heals
In CI, it halts the pipeline with exit code 1 to stop an insecure deploy. On your local machine, running dotvet fix automatically fills in secure random cryptographic secrets.
What Errors Does It Catch?
The specific mistakes dotvet prevents before they hit production:
HMAC-SHA256 tokens require 256 bits of entropy. Any variable named JWT_SECRET under 32 characters causes an instant failure, preventing dictionary cracking.
Catches values like "changeme", "your-secret-here", "dummy", "admin", or "123456".
Detects when your code needs a variable (e.g. DATABASE_URL) but your .env didn't provide it, preventing application boot crashes.
Warns you immediately if a .env file exists in your repository but isn't listed in your .gitignore file.
Passive reconnaissance glances at your Git commit graph. If someone committed a .env file in the past and then deleted it in a later commit, dotvet flags the exact commit hash, author, and whether it was pushed to a remote before scraper bots exploit it.
Your Team's Env Contract (.env.schema.json)
Never share unencrypted, broken .env files over Slack or DM again.
Generate Once, Enforce Everywhere
Running dotvet generate derives your application's complete environment schema:
- .env.example: Clean documentation of all required variables without exposing sensitive values.
- .env.schema.json: Machine-readable JSON Schema defining types, constraints, and descriptions for your team.
"$schema": "http://json-schema.org/draft-07/schema#",
"required": ["DATABASE_URL", "JWT_SECRET"],
"properties": {
"JWT_SECRET": { "minLength": 32, "type": "string" },
"PORT": { "default": "3000", "type": "integer" }
}
}
Command Reference
The simple commands you can run:
Default check. Scans code and audits your active .env file for errors and weak secrets.
Auto-repair. Generates secure 32-byte cryptographic keys, replaces placeholders, and updates .gitignore.
Generates .env.example and .env.schema.json contracts automatically from your code.
Installs dual Git hooks (pre-commit & pre-push) so nobody on your team can commit or push insecure secrets.
Add to GitHub Actions in 3 Lines
Block broken pull requests before they reach production with the official GitHub Action:
name: Env Security Gate
on: [push, pull_request]
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Verify Environment Variable Security
uses: EthicCodeTech/dotvet@main
with:
strict: 'true'
Show Your Repo Is Protected
Signal to your team and users that your project enforces environment security. Customize the shield color via URL parameter:
Includes official .v logo mark.
?color=cyan|green|purple|orange|pink