Over 25% of cloud deploy failures are triggered by undeclared environment variables, syntax mismatches, or accidental client browser credential exposures. EnvProof reconciles code against manifests in <500ms without ever reading raw secrets.
Select an architectural stack scenario below, inspect the code and manifest discrepancies, and run a live simulated scan to witness real-time drift resolution.
Run directly with npx or install into your GitHub Actions workflow in under 30 seconds.
Run an instant zero-exposure scan on your repository without installing anything:
# 60-second diagnostic scan on local repository
npx envproof scan
# Verbose mode with line-by-line file references
npx envproof scan --verbose
# Export interactive HTML audit report
npx envproof scan --html --out env-audit.html
Embed dynamic high-DPI verification badges into your repository READMEs, status dashboards, and internal developer portals.
[](https://envproof.spekra.in)
Satisfy strict enterprise change management audits with tamper-proof cryptographic attestation bundles.
Configuration baseline integrity & logical access: Statically verifies that application environments contain only authorized, versioned schema definitions with zero undeclared secrets.
Change documentation and management: Verifies complete reconciliation across code, templates, Docker compose manifests, and CI/CD workflows before deployments proceed.
Every audit bundle produces a deterministic SHA-256 seal computed over canonicalized schema JSON, guaranteeing non-repudiation for security and compliance reviewers.
Zero-dependency, local-first engine with offline HMAC signed license tokens. No phone-home servers required.
1 Developer / Local Machine
1 Repository / 5 Team Seats
Unlimited Repos / 20 Seats
Unlimited Repos & Seats
EnvProof strictly operates on code Abstract Syntax Trees (AST) and static manifest files. It extracts variable identifier names (e.g. process.env.DATABASE_URL) and checks for their existence in .env.example, Dockerfiles, and CI definitions. It never opens production .env files or queries secret managers.
EnvProof licenses (ep_lic_...) are self-contained, base64url-encoded JSON payloads cryptographically signed with SHA-256 HMAC tokens. The CLI validates the digital signature and expiration date locally without ever phoning home or requiring internet access during CI/CD execution.
EnvProof inspects Next.js (NEXT_PUBLIC_), Vite (VITE_), Create React App (REACT_APP_), Nuxt (NUXT_PUBLIC_), Gatsby (GATSBY_), and Expo (EXPO_PUBLIC_). Any variable with these prefixes containing sensitive keywords like SECRET, PASSWORD, PRIVATE_KEY, or MASTER_KEY is flagged as a CRITICAL leak hazard.
Yes. Running npx envproof sync --out .env.example parses your application code and automatically generates or updates your .env.example template with inferred types, default values, and source comments.