Skip to content
One Agent a DayIn → agent → out

Issue 25 · 29 Sep 2026 · Medium · Free

Env Var Auditor

The example file and the code drifted apart, and you cannot tell which key the app will demand at boot.

Paste .env.example and the code that reads it. Get missing keys, unused keys, and names that look like live secrets.

Category
Coding & Vibe Coding
Runs in
Cursor
Claude
ChatGPT
Tags
Vibe Coding
Env
Security

What you put in and what you get out

You put in

Paste the example and the reads. Copy .env.example and the lines that read process.env or the equivalent. Redact any real secret first; leave the name. A placeholder is fine.

Agent

Env Var Auditor

You get out

The fix. Add FLY_REGION=local. Change the Stripe example to a sk_test_ placeholder. Do not print a real key.

Sample you can paste

.env.example
PORT=3000
DATABASE_URL=postgres://localhost/ledger
STRIPE_SECRET_KEY=sk_live_replace_me

Code:
const port = process.env.PORT ?? "3000";
const db = process.env.DATABASE_URL;
if (!db) throw new Error("DATABASE_URL is required");
const stripe = process.env.STRIPE_SECRET_KEY;
const region = process.env.FLY_REGION;

Nobody reads FLY_REGION in the paste. The example contains a value that starts with sk_live_. I have not committed a real key. Tell me if the example is unsafe anyway.
Copy the promptDownload .txt

Share this agent

Env Var Auditor — You put in .env.example. You get out The fix. Free from One Agent a Day.

Share on XShare on LinkedIn

30-second demo

0:00

The drift

PORT and DATABASE_URL are read. DATABASE_URL is required. FLY_REGION is read and missing from the example.

How it works

The auditor compares two pastes: the example file and the lines that read environment variables. A key the code requires and the example hides will break the next boot. A key in the example that nothing reads is how secrets linger. A value that looks like a live credential does not belong in an example, even when you believe it is fake.

It does not need the real secret and should not be given one. It will not tell you how to use a leaked key. It tells you to rotate if a live-looking value was committed, and it shows the placeholder shape.

Update the example in the same commit as the code that reads the new name. Drift is how this list comes back.

Use it

  1. Step 1

    Paste the example and the reads

    Copy .env.example and the lines that read process.env or the equivalent. Redact any real secret first; leave the name. A placeholder is fine.

  2. Step 2

    Paste the prompt

    You get three lists: required by code and missing from the example, present in the example and unread, and names whose values look like live credentials.

  3. Step 3

    Fix the example, not the secret store

    Add the missing key with an obvious fake value. Remove or comment the unused key. Replace any live-looking value with a placeholder like sk_test_replace_me.

  4. Step 4

    Do not paste a rotated secret back into chat

    If a real key was in the file, rotate it in the provider. The auditor's job is the drift. It does not need the secret to finish.

Prompt

env-var-auditor.prompt.txt

Download
You compare an env example file to the code that reads env vars. You flag drift and live-looking placeholders. You do not ask for real secrets and you do not explain how to abuse a key.

INPUTS
- The example file.
- The lines that read env vars, with enough context to see a required check.

RULES
- Missing: read by code, absent from the example. Mark required if the code throws or refuses to boot without it.
- Unused: in the example, not read in the paste. Say the paste may be incomplete rather than claiming the key is dead in the whole repo.
- Live-looking: values that use a live prefix (sk_live_, rk_live_, AKIA, a private key header, a real-looking connection string with a password). Tell them to replace with an obvious fake. Do not repeat the secret; repeat the name and the prefix only.
- Do not invent keys.
- Do not provide exploit steps for a leaked key. The remediation is: rotate in the provider, then replace the example.
- If they pasted a real-looking full key, tell them to rotate and do not echo the value.

OUTPUT
## Missing
## Unused
## Live-looking
## Example lines to change
Name and a safe placeholder.

## Rotate
Yes or no, and which name. No values.

Config

env-var-auditor.defaults.json

Download
{
  "version": 1,
  "livePrefixes": [
    "sk_live_",
    "rk_live_",
    "AKIA",
    "-----BEGIN"
  ],
  "echoSecretValues": false,
  "exploitSteps": false
}
Was this useful?

A yes or no is enough. The note stays on this server's log.

Related agents

  1. Coding & Vibe Coding11 Oct 2026 · #37Vibe-code Security CheckerA review prompt for vibe-coded diffs. It hunts secrets, missing auth, injection, and insecure defaults, then names the fix.InStack: Next.js route handler, TypeScript, Postgres via a query string.OutWhat it will not doMedium
  2. Coding & Vibe Coding17 Sep 2026 · #13Test Plan from the PromptPaste the prompt you used to vibe-code a feature. Get the checks to run before merge, including the case that prompt forgot.InPrompt I gave Cursor:OutLaterMedium
  3. Coding & Vibe Coding5 Sep 2026 · #01Diff Risk ReviewerRead a vibe-coded diff for behavior risk: what changed, what can break, and which check to run before you push.Indiff --git a/app/api/orders/route.ts b/app/api/orders/route.tsOutThe checkMedium

Tomorrow's drop

Get the next agent in your inbox

One email when the drop goes up. No digest, no course. Unsubscribe whenever the provider lets you.

Pro and custom

€9/month when Pro opens

Early look at the next drop, a better archive, and the occasional agent that does not fit the public mix. The daily agent stays free. A custom build is €49–199. Nothing is charged from this form.

Join the Pro waitlist