Catch missing env vars
before a deploy does.
Most tools only compare .env with .env.example. env-drift reads everything that touches configuration (your code in 9 languages, .env files, Dockerfile, docker compose, GitHub Actions, Kubernetes and next.config) and tells you what's missing, undocumented, unused or leaking to the browser. One command, works in CI.
Try it in your browser
Runs locally · nothing is uploadedChecks
Missing
Read by the app (with no default) but set nowhere: not in .env, compose, the Dockerfile, Kubernetes or the example file. The classic "works on my machine".
Leaking to the browser
NEXT_PUBLIC_, VITE_, REACT_APP_ and friends on a secret-looking name means it ends up in your JavaScript bundle. Publishable keys are fine.
Secrets in examples
Real-looking keys (Stripe live keys, GitHub and AWS tokens, JWTs, URLs with passwords) in a committed .env.example.
Undocumented
Set in your local .env but missing from the example file, so teammates and new servers won't know to set it.
CI secrets
Lists the secrets and variables your GitHub workflows need, and with --github owner/repo checks that the repo actually has them.
Unused
Variables in .env files that nothing reads any more. Clean them up and shrink the list of secrets you manage.
Add it to CI
name: env-drift on: [pull_request] jobs: env: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: npx -y @tirthlabs/env-drift --ci
npx @tirthlabs/env-drift [dir] --ci exit 1 on errors --strict warnings fail too --fix add missing vars to .env.example --github o/repo check Actions secrets exist --ignore A,B_* skip variables --json machine-readable report