EnvGuard: An Open-Source CLI to Automate .env Validation and Security

Introducing EnvGuard: Catch .env Mistakes Before They Break Your App

EnvGuard is an open-source .env validator designed to catch configuration errors before they reach production. It automates checks for missing keys and type mismatches against .env.example and .env.schema files.

Why This Matters

In modern development, configuration failures are visibility problems where local environments break due to missing variables or runtime bugs caused by type mismatches, such as strings being passed as booleans. EnvGuard shifts feedback earlier in the development lifecycle, preventing expensive deployment failures by enforcing strict contract validation between .env.example and .env.schema.

Key Insights

• EnvGuard detects missing keys by comparing active .env files against .env.example templates to ensure developer environment parity (Adeyemi, 2026).
• Type validation via .env.schema supports complex types including string, int, float, bool, url, email, and json to prevent runtime casting errors.
• The tool includes secret detection capabilities that flag high-entropy values and known token patterns to prevent accidental exposure of credentials.
• EnvGuard is implemented in Go and supports a ‘watch’ mode for continuous feedback during active development sessions.
• The CLI provides a —strict mode specifically for CI environments to enforce configuration integrity before deployment.

Working Examples

Validates the .env file against a specified schema for type correctness.

envguard validate --schema .env.schema

Runs EnvGuard in watch mode to provide instant feedback as files change.

envguard watch --schema .env.schema

Installation command for the EnvGuard CLI tool.

go install github.com/atoyegbe/envguard@latest

Practical Applications

• CI/CD Integration: Running ‘envguard validate —strict’ in build pipelines to block deployments with missing or malformed configuration. Pitfall: Skipping automated validation allows stale environment keys to cause silent runtime failures.
• Local Development: Using ‘envguard watch’ to ensure local environments remain synchronized with .env.example updates from other team members. Pitfall: Manual maintenance of .env files often leads to ‘it works on my machine’ bugs.

References:

• https://dev.to/deyemie/introducing-envguard-catch-env-mistakes-before-they-break-your-app-32mg