Environment Audit
Purpose
Assess how the project handles environment configuration and secrets: whether required variables are validated, secrets stay server-side, debug is off in production, and environments are consistent — so deploys don't fail or leak.
When to Use
- During an existing-project audit, before deployment, or in a security pass.
- When diagnosing config-related failures or missing-variable errors.
- Not to print or handle real secret values.
Inputs
- Config files,
.env.example, .gitignore, build/deploy config (read-only).
- Target environments (dev/staging/prod) and their differences.
Discovery Questions
- Which env vars are required, and does the app fail fast if they're missing?
- Are secrets server-side only; is
.env git-ignored; is .env.example present with placeholders?
- Is debug/verbose mode off in production?
- Is there parity across environments, or drift?
Responsibilities
- Verify required env vars are referenced and fail-fast on absence.
- Verify secret handling: server-side only,
.env ignored, .env.example with placeholders, no client-exposed prefixes holding secrets.
- Check debug/runtime settings default safe in production.
- Assess environment parity and flag drift.
- Flag exposure without printing secret values (
../../system/SECURITY_RULES.md).
Required Workflow
- Read config,
.env.example, .gitignore, build/deploy files.
- Cross-check referenced vars vs documented vars.
- Verify fail-fast on missing critical vars.
- Check secret placement and client exposure (redacted).
- Check debug defaults and environment parity.
- Record findings and gaps.
Decision Rules
- Missing fail-fast on a critical var is a High finding.
- Any secret with a client-exposed prefix is a Critical finding → rotate + move server-side.
- Debug on in production is a finding.
- Prefer parity; document intentional per-environment differences.
Rules
- Read-only; never print secret values (report location/type redacted).
- Recommend a placeholder
.env.example if missing.
- Coordinate deeper secret analysis with
security-review.
Anti-Patterns
- Printing real secret values.
- Ignoring missing env validation.
- Assuming parity without checking.
- Treating client-exposed secrets as acceptable.
Validation Checklist
Definition of Done
An environment/config report: env-var validation status, secret-handling posture (redacted), production debug settings, and parity/drift findings — with justified recommendations and no secret values printed.
Related Skills
existing-project-audit, dependency-audit, security-review, release-planning, migration-planning, final-quality-audit.
Related Knowledge
../../knowledge/ (deploy targets), ../../mcp/ (tool exposure).
Related References
../../mcp/PERMISSION_RULES.md (data exposure).
Context Loading Guidance
- Requires: config files,
.env.example, .gitignore, build/deploy config, target envs.
- Does not require: full application source, references, planning skills' bodies.
- May load:
security-review for deep secret analysis.
- Stop when: the environment report is recorded.
Token Efficiency Guidance
Focus on config and deploy files, not app logic. Redact and quote only what's needed to locate a finding.
1---2name: environment-audit3description: Use to assess environment and configuration health — env-var usage and fail-fast, config/secrets handling, build/runtime settings, and parity across dev/staging/prod. Flags exposure and missing validation without printing secret values.4---56# Environment Audit78## Purpose910Assess how the project handles environment configuration and secrets: whether required variables are validated, secrets stay server-side, debug is off in production, and environments are consistent — so deploys don't fail or leak.1112## When to Use1314- During an existing-project audit, before deployment, or in a security pass.15- When diagnosing config-related failures or missing-variable errors.16- **Not** to print or handle real secret values.1718## Inputs1920- Config files, `.env.example`, `.gitignore`, build/deploy config (read-only).21- Target environments (dev/staging/prod) and their differences.2223## Discovery Questions2425- Which env vars are required, and does the app fail fast if they're missing?26- Are secrets server-side only; is `.env` git-ignored; is `.env.example` present with placeholders?27- Is debug/verbose mode off in production?28- Is there parity across environments, or drift?2930## Responsibilities3132- Verify **required env vars** are referenced and **fail-fast** on absence.33- Verify **secret handling**: server-side only, `.env` ignored, `.env.example` with placeholders, no client-exposed prefixes holding secrets.34- Check **debug/runtime settings** default safe in production.35- Assess **environment parity** and flag drift.36- Flag exposure without printing secret values (`../../system/SECURITY_RULES.md`).3738## Required Workflow39401. Read config, `.env.example`, `.gitignore`, build/deploy files.412. Cross-check referenced vars vs documented vars.423. Verify fail-fast on missing critical vars.434. Check secret placement and client exposure (redacted).445. Check debug defaults and environment parity.456. Record findings and gaps.4647## Decision Rules4849- Missing fail-fast on a critical var is a High finding.50- Any secret with a client-exposed prefix is a Critical finding → rotate + move server-side.51- Debug on in production is a finding.52- Prefer parity; document intentional per-environment differences.5354## Rules5556- Read-only; never print secret values (report location/type redacted).57- Recommend a placeholder `.env.example` if missing.58- Coordinate deeper secret analysis with `security-review`.5960## Anti-Patterns6162- Printing real secret values.63- Ignoring missing env validation.64- Assuming parity without checking.65- Treating client-exposed secrets as acceptable.6667## Validation Checklist6869- [ ] Required vars referenced + fail-fast verified.70- [ ] Secrets server-side; `.env` ignored; `.env.example` present.71- [ ] No client-exposed prefix holds a secret.72- [ ] Debug defaults safe in production.73- [ ] Environment parity assessed; drift flagged.74- [ ] No secret values printed.7576## Definition of Done7778An environment/config report: env-var validation status, secret-handling posture (redacted), production debug settings, and parity/drift findings — with justified recommendations and no secret values printed.7980## Related Skills8182`existing-project-audit`, `dependency-audit`, `security-review`, `release-planning`, `migration-planning`, `final-quality-audit`.8384## Related Knowledge8586`../../knowledge/` (deploy targets), `../../mcp/` (tool exposure).8788## Related References8990`../../mcp/PERMISSION_RULES.md` (data exposure).9192## Context Loading Guidance9394- **Requires:** config files, `.env.example`, `.gitignore`, build/deploy config, target envs.95- **Does not require:** full application source, references, planning skills' bodies.96- **May load:** `security-review` for deep secret analysis.97- **Stop when:** the environment report is recorded.9899## Token Efficiency Guidance100101Focus on config and deploy files, not app logic. Redact and quote only what's needed to locate a finding.
ahtishamshahzad