EnvShield turns one schema into your project's Environment Contract. Define it once, and get generated docs, drift-proof validation, secret scanning, and typed, secret-masked config code — for Python or TypeScript — for free.
pip install envshield
Secret leaks and configuration bugs happen because `.env` files are an afterthought. EnvShield makes them a core, governed part of your project with a single source of truth: the `env.schema.toml` file.
Explicitly define every environment variable your project needs in a simple, version-controlled schema. No more guessing what `API_KEY` is for.
Say goodbye to outdated `.env.example` files. `envshield schema sync` generates a perfect, commented example file directly from your schema, every time.
`envshield check` and `envshield scan` ensure that every local setup and every line of code adheres to the contract, eliminating drift and "shadow" variables.
`envshield generate` compiles your contract into real, importable `pydantic-settings` (Python) or `zod` (TypeScript) — with secrets masked by default, everywhere they'd otherwise leak.
Guides, tutorials, and deep dives into modern development workflows.
Workflow & Productivity
If your project's
.env.example file had a
relationship status, it would be “It’s
Complicated.” Time for an upgrade...
Security & Secret Management
Compare two of 2025’s top secret-scanning tools and find out which fits your workflow best.
EnvShield transforms your most painful workflows into a secure, automated process.
Run `envshield init` in a new or existing project. EnvShield intelligently detects your framework (Next.js, Django, Flask) and scaffolds a complete, best-practice foundation: a schema, a `.gitignore` update, and an automated security hook, all in one command.
envshield init
All the commands you need to enforce a secure and consistent local workflow.
Scaffolds a new project with a schema, config, and security hook in one command.
Intelligently converts a messy, existing `.env` file into a clean `env.schema.toml` in seconds.
Scans for hardcoded secrets and undeclared variables used in your code, preventing leaks.
Auto-generates a perfect `.env.example` from your schema, keeping documentation in sync.
An interactive wizard to help new developers create their local `.env` file in minutes.
Validates your local `.env` file against the schema, catching typos and missing variables.
Runs a full health check on your setup and provides interactive fixes with the `--fix` flag.
Compiles your schema into a typed, validated `pydantic-settings` or `zod` config module — auto-detected for your stack, or set with `--lang`.
A scanner is a smoke detector. A cloud vault is a bank. EnvShield is the fireproof, self-organizing house you should have been living in all along.
| Developer Pain Point | 🛡️ EnvShield | TruffleHog / Gitleaks | Doppler / Infisical |
|---|---|---|---|
| Preventing Secret Commits | ✅ Built-in Hook | ✅ Core Feature | ❌ Indirectly |
| Migrating Existing Projects | ✅ `import` command | ❌ Not Addressed | ❌ Not Addressed |
| New Developer Setup | ✅ `setup` command | ❌ Not Addressed | ✅ Via Cloud |
| Handling Config Drift | ✅ Solved via Schema | ❌ Not Addressed | ✅ Solved via Cloud |
| Typed, Validated Config Code | ✅ `generate` (Python & TypeScript) | ❌ Not Addressed | ❌ Not Addressed |
| Primary Focus | Complete Local Workflow | Secret Detection Engine | Cloud-Based Secret Vault |
Phase 1 is the free, powerful "Local Guardian." Upcoming paid tiers will turn EnvShield into a complete collaboration and automation platform for teams and enterprises.