Environment Variable Security Audit
Audit environment variable configurations by encoding, hashing, and comparing values across different deployment environments.
When to Use This Workflow
Audit and compare environment variable configurations across staging and production to catch misconfigurations and exposed secrets.
Workflow Steps
Base64 Encoder
Decode Base64-encoded secrets from environment configs to verify values
Hash Generator
Hash sensitive values to create comparable fingerprints without exposing secrets
Diff Checker
Compare sanitized .env files between environments to find discrepancies
Download Workflow Template
Frequently Asked Questions
How do I compare secrets across environments without exposing them?
Hash each secret with SHA-256 and compare the hashes. If staging and production hashes match, the secrets are identical — without ever displaying the actual values in plain text.
What environment variables should never be in version control?
API keys, database passwords, JWT secrets, OAuth client secrets, encryption keys, and any PII. Use .gitignore for .env files and a secrets manager (Vault, AWS SSM) for production.
How do I audit for accidentally committed secrets?
Run 'git log --all -p | grep -i password' or use tools like git-secrets or truffleHog. This workflow helps verify current environment files are properly configured.