Configuration orchestration for multi-service projects. One schema for all services. Typed config code. Interactive onboarding. Drift prevention. Secret scanning. All free, all local, all in your git repo.
pip install envshield
Multi-service projects have scattered .env files across services. Nobody knows what variables each service needs. New devs spend 2 hours figuring it out. Configuration drifts between environments silently. EnvShield solves this with one schema that all services agree on.
One env.schema.toml per service. One envshield.yml ties them together. Only tool with native multi-service support.
New dev runs envshield setup. Prompted with descriptions. Secrets hidden. Done. No Slack threads. No manual guessing.
envshield doctor catches config mismatches before they reach production. envshield check validates your .env.
Generate real Python (pydantic) or TypeScript (zod) code. Only tool that does this. Type-safe. Validated on startup. Secrets masked.
Pre-commit hook scans staged content (not working-tree). Catches hardcoded secrets you edited out on disk. Free and local.
envshield schema sync regenerates .env.example from schema. One source of truth. Documentation never rots.
Guides, tutorials, and deep dives into modern development workflows.
Workflow & Productivity
If your project's
.env.example file had a
relationship status, it would be “It’s
Complicated.” Time for an upgrade...
Security & Secret Management
Compare two of 2025’s top secret-scanning tools and find out which fits your workflow best.
EnvShield transforms your most painful workflows into a secure, automated process.
Run `envshield init` in a new or existing project. EnvShield intelligently detects your framework (Next.js, Django, Flask) and scaffolds a complete, best-practice foundation: a schema, a `.gitignore` update, and an automated security hook, all in one command.
envshield init
EnvShield is the only tool that treats configuration as a contract across multiple services.
| EnvShield | Gitleaks | dotenvx | Infisical | direnv | |
|---|---|---|---|---|---|
| Multi-service support | ✅ Built-in | ❌ | ❌ | ❌ | ❌ |
| Schema-driven | ✅ Unique | ❌ | ❌ | ❌ | ❌ |
| Typed code generation | ✅ Unique | ❌ | ❌ | ❌ | ❌ |
| Interactive onboarding | ✅ | ❌ | ❌ | ✅ Cloud-only | ❌ |
| Works offline | ✅ | ✅ | ✅ | ❌ | ✅ |
| Prevent secrets at commit | ✅ | ✅ Better detection | ✅ | ✅ (stores them) | ❌ |
The difference: EnvShield is the only tool that treats configuration as a contract with support for multiple services. Others solve pieces of the puzzle; EnvShield solves the whole problem.
Comprehensive commands for schema management, validation, code generation, secret scanning, and onboarding. Works with single-service or multi-service projects.
Scaffolds a new project with a schema, config, and security hook in one command.
Intelligently converts a messy, existing `.env` file into a clean `env.schema.toml` in seconds.
Scans for hardcoded secrets and undeclared variables used in your code, preventing leaks.
Auto-generates a perfect `.env.example` from your schema, keeping documentation in sync.
An interactive wizard to help new developers create their local `.env` file in minutes.
Validates your local `.env` file against the schema, catching typos and missing variables.
Runs a full health check on your setup and provides interactive fixes with the `--fix` flag.
Compiles your schema into a typed, validated `pydantic-settings` or `zod` config module — auto-detected for your stack, or set with `--lang`.
Installs a Git pre-commit hook that automatically runs secret scanning before each commit. Prevents secrets from ever reaching your repository.
A scanner is a smoke detector. A cloud vault is a bank. EnvShield is the fireproof, self-organizing house you should have been living in all along.
| Developer Pain Point | 🛡️ EnvShield | TruffleHog / Gitleaks | Doppler / Infisical |
|---|---|---|---|
| Preventing Secret Commits | ✅ Built-in Hook | ✅ Core Feature | ❌ Indirectly |
| Migrating Existing Projects | ✅ `import` command | ❌ Not Addressed | ❌ Not Addressed |
| New Developer Setup | ✅ `setup` command | ❌ Not Addressed | ✅ Via Cloud |
| Handling Config Drift | ✅ Solved via Schema | ❌ Not Addressed | ✅ Solved via Cloud |
| Typed, Validated Config Code | ✅ `generate` (Python & TypeScript) | ❌ Not Addressed | ❌ Not Addressed |
| Primary Focus | Complete Local Workflow | Secret Detection Engine | Cloud-Based Secret Vault |
Phase 1 is the free, powerful "Local Guardian." Upcoming paid tiers will turn EnvShield into a complete collaboration and automation platform for teams and enterprises.