Secrets Env Management

Secrets Env Management

Goal

Help projects use environment variables safely without exposing secrets.

When to use

Use when adding environment variables, reading .env.example, documenting credentials, configuring deployment secrets, or investigating leaked keys.

When not to use

Do not use to reveal, print, decode, test, or share secret values.

Inputs

Inspect .env.example, deployment docs, config files, required variable names, and .gitignore. Do not open real secret files unless the user explicitly asks for a safety review, and never reproduce values.

Workflow

1. Identify required variable names without printing values.
2. Ensure real env files are ignored by git.
3. Create or update .env.example with placeholders only.
4. Document where variables are configured locally and in deployment.
5. Add validation for required variables when useful.
6. Warn when production/live credentials appear exposed.
7. Recommend rotation for any credential that may have been shared.

Safety rules

• Never print full secrets.
• Never commit .env, agent.env, PEM files, or private keys.
• Never place live values in examples.
• Prefer project-specific credentials with least privilege.

Validation

Run secret scan, git status, and any env validation script added to the project.

Final response

Report variable names only, files changed, validation commands, and rotation recommendations without revealing secret values.