Configuration orchestration for multi-service projects. One schema for all services. Typed config code. Interactive onboarding. Drift prevention. Secret scanning. All free, all local, all in your git repo.
pip install envshield
Multi-service projects have scattered .env files across services. Nobody knows what variables each service needs. New devs spend 2 hours figuring it out. Configuration drifts between environments silently. EnvShield solves this with one schema that all services agree on.
One env.schema.toml per service, one envshield.yml tying them together — and envshield service discover finds every service and seeds all their schemas in one command. Built for multi-service from the ground up.
New dev runs envshield setup. Prompted with descriptions. Secrets hidden. Done. No Slack threads. No manual guessing.
envshield doctor catches config mismatches before they reach production. envshield check validates your .env.
Generate real Python (pydantic) or TypeScript (zod) code straight from your schema. Type-safe. Validated on startup. Secrets masked.
Pre-commit hook scans staged content (not working-tree). Catches hardcoded secrets you edited out on disk. Free and local.
envshield schema sync regenerates .env.example from schema. One source of truth. Documentation never rots.
Guides, tutorials, and deep dives into modern development workflows.
Workflow & Productivity
If your project's
.env.example file had a
relationship status, it would be “It’s
Complicated.” Time for an upgrade...
Security & Secret Management
Compare two of 2025’s top secret-scanning tools and find out which fits your workflow best.
EnvShield transforms your most painful workflows into a secure, automated process.
Run `envshield init` in a new or existing project. EnvShield intelligently detects your framework (Next.js, Django, Flask) and scaffolds a complete, best-practice foundation: a schema, a `.gitignore` update, and an automated security hook, all in one command.
envshield init
$ envshield service discover
Discovered Services
┏━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Name ┃ Directory ┃ Format ┃ Config File ┃
┡━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━┩
│ api │ services/api │ dotenv │ (default .env) │
│ web │ services/web │ dotenv │ (default .env) │
└────────┴────────────────┴────────┴───────────────────────┘
? Add these services to envshield.yml? Yes
✓ Registered api → services/api/env.schema.toml
✓ Registered web → services/web/env.schema.toml
✨ Added 2 service(s) to envshield.yml.
envshield init sets up one schema for one
service. In a monorepo, run
envshield service discover instead: it
scans for every service with its own real config —
a dotenv file or a recognizable Python config module —
registers each one, and seeds its schema from its
actual current values. Run it again later and it only
picks up what's new, leaving already-configured
services untouched.
envshield service discoverEnvShield treats configuration as a contract across multiple services — here's how that compares to the tools people usually reach for instead.
| EnvShield | Gitleaks | dotenvx | Infisical | direnv | |
|---|---|---|---|---|---|
| Multi-service support | ✅ Built-in | ❌ | ❌ | ❌ | ❌ |
| Schema-driven | ✅ Unique | ❌ | ❌ | ❌ | ❌ |
| Typed code generation | ✅ Unique | ❌ | ❌ | ❌ | ❌ |
| Interactive onboarding | ✅ | ❌ | ❌ | ✅ Cloud-only | ❌ |
| Works offline | ✅ | ✅ | ✅ | ❌ | ✅ |
| Prevent secrets at commit | ✅ | ✅ Better detection | ✅ | ✅ (stores them) | ❌ |
The difference: Gitleaks, dotenvx, Infisical, and direnv each solve one piece of the configuration puzzle. EnvShield's schema-as-contract approach, with native multi-service support, is a different angle on the same problem.
Comprehensive commands for schema management, validation, code generation, secret scanning, and onboarding. Works with single-service or multi-service projects.
Scaffolds a new project with a schema, config, and security hook in one command.
Intelligently converts a messy, existing `.env` file into a clean `env.schema.toml` in seconds.
Finds every service in a monorepo, registers
them, and seeds each schema from its real
config — one command instead of hand-writing
envshield.yml and importing each
service one by one.
Scans for hardcoded secrets and undeclared variables used in your code, preventing leaks.
Auto-generates a perfect `.env.example` from your schema, keeping documentation in sync.
An interactive wizard to help new developers create their local `.env` file in minutes.
Validates your local `.env` file against the schema, catching typos and missing variables.
Runs a full health check on your setup and provides interactive fixes with the `--fix` flag.
Compiles your schema into a typed, validated `pydantic-settings` or `zod` config module — auto-detected for your stack, or set with `--lang`.
Installs a Git pre-commit hook that automatically runs secret scanning before each commit. Prevents secrets from ever reaching your repository.
A scanner is a smoke detector. A cloud vault is a bank. EnvShield is the fireproof, self-organizing house you should have been living in all along.
| Developer Pain Point | 🛡️ EnvShield | TruffleHog / Gitleaks | Doppler / Infisical |
|---|---|---|---|
| Preventing Secret Commits | ✅ Built-in Hook | ✅ Core Feature | ❌ Indirectly |
| Migrating Existing Projects | ✅ `import` command | ❌ Not Addressed | ❌ Not Addressed |
| New Developer Setup | ✅ `setup` command | ❌ Not Addressed | ✅ Via Cloud |
| Handling Config Drift | ✅ Solved via Schema | ❌ Not Addressed | ✅ Solved via Cloud |
| Typed, Validated Config Code | ✅ `generate` (Python & TypeScript) | ❌ Not Addressed | ❌ Not Addressed |
| Primary Focus | Complete Local Workflow | Secret Detection Engine | Cloud-Based Secret Vault |
Phase 1 is the free, powerful "Local Guardian." Upcoming paid tiers will turn EnvShield into a complete collaboration and automation platform for teams and enterprises.