.env File,One schema describes every variable your app needs — its type, whether it's secret, when it's required. EnvShield uses it to onboard new developers, catch drift before production, generate typed config code, and validate the deployment manifest that actually ships it. Free, open source, and it never leaves your machine.
pip install envshield
.env.example drifts out of date. Nobody's sure which variables are secret. A new hire spends their first afternoon guessing. Config that works locally breaks in staging because nobody told the worker service about the new API key. EnvShield fixes this with one schema — and it scales to a monorepo with a dozen services just as well as it works for one.
Declare type = "port", an enum, a regex pattern, or a conditional requiredIf on any variable. check/doctor/setup enforce it; a typo'd log level or an out-of-range port gets caught before you run the app.
envshield check reads a docker-compose file or a Kubernetes manifest directly — the config that actually ships, checked the same way your local .env is.
One env.schema.toml per service, one envshield.yml tying them together, and extends for variables every service shares. envshield service discover finds every service and seeds all their schemas in one command.
New dev runs envshield setup. Prompted with descriptions, secrets hidden, enum fields shown as a picker. It tells you exactly which variables you need and which are secret — you still get the actual secret values from your team the way you always have.
envshield doctor catches config mismatches — including in your deployment manifest, if one's registered — before they reach production. envshield check makes a solid CI gate.
Generate real Python (pydantic) or TypeScript (zod) code straight from your schema. Type-safe, validated on startup, secrets masked by construction, not convention.
Pre-commit hook scans only newly-added lines in excluded files. Allows intentional baseline secrets while catching real ones. Line-level, positional diff — not a text-content guess.
Installed with one prompt, never repeated. Respects a configured core.hooksPath (e.g. Husky) instead of assuming .git/hooks. Overwriting always tells you what would be lost first.
envshield schema sync regenerates .env.example from schema. One source of truth. Documentation never rots.
Guides, tutorials, and deep dives into modern development workflows.
Workflow & Productivity
If your project's
.env.example file had a
relationship status, it would be “It’s
Complicated.” Time for an upgrade...
Security & Secret Management
Compare two of 2025’s top secret-scanning tools and find out which fits your workflow best.
EnvShield transforms your most painful workflows into a secure, automated process.
Run `envshield init` in a new or existing project. EnvShield intelligently detects your framework (Next.js, Django, Flask) and scaffolds a complete, best-practice foundation: a schema, a `.gitignore` update, and an automated security hook, all in one command.
envshield init
$ envshield service discover
Discovered Services
┏━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Name ┃ Directory ┃ Format ┃ Config File ┃
┡━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━┩
│ api │ services/api │ dotenv │ (default .env) │
│ web │ services/web │ dotenv │ (default .env) │
└────────┴────────────────┴────────┴───────────────────────┘
? Add these services to envshield.yml? Yes
✓ Registered api → services/api/env.schema.toml
✓ Registered web → services/web/env.schema.toml
✨ Added 2 service(s) to envshield.yml.
envshield init sets up one schema for one
service. In a monorepo, run
envshield service discover instead: it
scans for every service with its own real config —
a dotenv file or a recognizable Python config module —
registers each one, and seeds its schema from its
actual current values. Run it again later and it only
picks up what's new, leaving already-configured
services untouched.
envshield service discoverEnvShield isn't trying to replace any of these — it's the schema/contract/codegen layer that sits alongside whichever you already use.
| EnvShield | Gitleaks | dotenvx | Doppler / Infisical | |
|---|---|---|---|---|
| Schema-driven validation (types, enums, conditional requirements) | ✅ | ❌ | ❌ | ❌ |
| Multi-service schemas, with shared/composed definitions | ✅ | ❌ | ❌ | Partial (multi-environment, not a documented shared contract) |
| Typed config code generation | ✅ | ❌ | ❌ | ❌ |
| Validates deployment manifests (compose, Kubernetes) | ✅ | ❌ | ❌ | ❌ |
| Interactive onboarding | ✅ | ❌ | ❌ | ✅ (hosted) |
| Secret detection depth/accuracy | ⚠️ Good enough for most teams | ✅ Best in class, actively maintained | ✅ | Varies by plan |
| Syncs real secret values across a team | ❌ (never touches real values) | ❌ | Encrypts values in the file | ✅ |
| Works fully offline | ✅ Always | ✅ | ✅ | Depends on plan/self-hosting |
The honest version: if raw secret-detection accuracy matters most to you, run Gitleaks alongside EnvShield rather than relying on scan alone. If syncing real secret values across a team is what you need, Doppler/Infisical do that and EnvShield deliberately doesn't. What EnvShield does that none of these do: one schema, in your own repo, that's a validation contract, a codegen input, and something your deployment manifests get checked against.
Comprehensive commands for schema management, validation, code generation, secret scanning, and onboarding. Works with single-service or multi-service projects.
Scaffolds a new project with a schema, config, and security hook in one command.
Converts a messy, existing `.env` file into a clean `env.schema.toml`, inferring each variable's type where the value's shape is unambiguous.
Finds every service in a monorepo, registers
them, and seeds each schema from its real
config — one command instead of hand-writing
envshield.yml and importing each
service one by one.
Scans for hardcoded secrets and undeclared variables used in your code, preventing leaks.
Auto-generates a perfect `.env.example` from your schema, keeping documentation in sync.
An interactive wizard to help new developers create their local `.env` file in minutes.
Validates your local `.env` — or your docker-compose file, or a Kubernetes manifest — against the schema, catching type mismatches, typos, and missing variables.
Runs a full health check on your setup and provides interactive fixes with the `--fix` flag.
Compiles your schema into a typed, validated `pydantic-settings` or `zod` config module — auto-detected for your stack, or set with `--lang`.
Installs a Git pre-commit hook that automatically runs secret scanning before each commit. Prevents secrets from ever reaching your repository.
Three different jobs. Pick based on which one is actually yours — or use more than one together.
| Developer Pain Point | 🛡️ EnvShield | TruffleHog / Gitleaks | Doppler / Infisical |
|---|---|---|---|
| Detecting Secrets in Commits | ⚠️ Built-in hook, good enough for most teams | ✅ Core feature, best-in-class detection | ❌ Not their job — they store secrets, they don't scan commits for them |
| Validating Deployment Manifests | ✅ `check` reads compose/Kubernetes files directly | ❌ Not addressed | ❌ Not addressed |
| Migrating Existing Projects | ✅ `import` command | ❌ Not addressed | ❌ Not addressed |
| New Developer Setup | ✅ `setup` command, works offline | ❌ Not addressed | ✅ Hosted dashboard |
| Handling Config Drift | ✅ Solved via schema (`doctor`/`check`) | ❌ Not addressed | ✅ Solved via cloud sync |
| Typed, Validated Config Code | ✅ `generate` (Python & TypeScript) | ❌ Not addressed | ❌ Not addressed |
| Syncing Real Secret Values Across a Team | ❌ Not addressed — see the Roadmap | ❌ Not addressed | ✅ Their whole job |
| Primary Focus | Schema, Validation & Codegen | Secret Detection Engine | Cloud-Based Secret Vault |
Probably yes if you have more than a couple of environment variables, more than one person touching the project, or more than one environment (dev/staging/prod) — that's when a plain .env file starts drifting.
Probably not yet if you need to distribute real secret values to a team securely right now — EnvShield doesn't do that (see the Roadmap) — Doppler or Infisical's free tiers solve that today. And if raw secret-detection accuracy is your top priority, pair EnvShield's scanner with Gitleaks rather than relying on it alone.