envguard: a linter and a safe for .env files

envguard is a Go console utility for .env files: it checks them against a schema, looks for secrets in the working tree and git history, encrypts .env into .env.sealed and runs commands with a clean environment. A side project.

One binary and only the Go standard library (there is no go.sum). The main rule of the project: a secret value never reaches the output, the log, an error, the HTML or the JSON. What is printed is the finding type, file, line and a four-character mask (for values of 12 characters and more); for short values only the length. Tests with canary values over the output of every command check this.

Limitations

There is no live version: it is a console utility.

In Go a secret cannot be reliably wiped from memory: passphrase and key buffers are zeroed, but variable values live in strings until garbage collection. Memory dumps and swap stay in the attacker model.

The scanner finds known formats and suspicious values; a secret of an arbitrary shape, encoded or inside a binary file, is missed, and the heuristics give false positives. Git history is checked in a limited way: the last N commits.

PBKDF2 is weaker against GPUs than scrypt and Argon2: that is the price of having no external modules. The -race check runs only in CI, file permissions are not checked on Windows.