env-sentry 0.1.0__tar.gz

env_sentry-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Your Name
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

env_sentry-0.1.0/PKG-INFO

@@ -0,0 +1,125 @@
+Metadata-Version: 2.4
+Name: env-sentry
+Version: 0.1.0
+Summary: A tiny, zero-dependency CLI that keeps your .env setup safe and in sync.
+Author: nour yahyaoui
+License: MIT
+Project-URL: Homepage, https://github.com/nour-yahyaoui/env-sentry
+Project-URL: Issues, https://github.com/nour-yahyaoui/env-sentry/issues
+Keywords: env,dotenv,security,secrets,cli,devtools
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Build Tools
+Classifier: Topic :: Security
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# 🛡️ env-sentry
+
+**Stop leaking secrets in `.env` files. Zero dependencies, one command.**
+
+[![PyPI](https://img.shields.io/badge/pip%20install-env--sentry-blue)](https://pypi.org/project/env-sentry/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org)
+[![Zero Dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](pyproject.toml)
+
+Every project with a `.env` file eventually has one of these moments:
+
+- Someone's `.env` isn't in `.gitignore` and real secrets get pushed to GitHub.
+- `.env.example` drifts out of sync, and a new teammate spends 20 minutes figuring out which env vars they're missing.
+- A Stripe key or AWS credential gets hardcoded "just for testing" and never gets cleaned up.
+
+`env-sentry` is a tiny CLI that catches all three, in one command, with **no dependencies to install**.
+
+---
+
+## Install
+
+```bash
+pip install env-sentry
+```
+
+## Quick start
+
+```bash
+# Scaffold .env.example and make sure .env is git-ignored
+env-sentry init
+
+# Compare .env against .env.example, flag drift and leaked secrets
+env-sentry check
+
+# Regenerate .env.example from .env (values are redacted, never copied)
+env-sentry sync
+
+# Scan the whole repo for hardcoded API keys, tokens, and private keys
+env-sentry scan
+```
+
+### Example output
+
+```
+$ env-sentry check
+
+❌ Keys in .env but missing from .env.example:
+   - STRIPE_SECRET_KEY
+   - DATABASE_URL
+
+🚨 .env.example may contain REAL secret values, not placeholders:
+   - OLD_API_KEY
+
+🚨 '.env' does not appear to be listed in .gitignore!
+   Anyone who commits will leak real secrets. Run `env-sentry init` to fix this.
+```
+
+```
+$ env-sentry scan
+
+config.py:14  AWS Access Key
+config.py:14  Suspicious value for 'AWS_SECRET'
+notes.txt:3   GitHub Token
+
+🚨 3 potential secret(s) found. Review before committing/pushing.
+```
+
+---
+
+## What it checks for
+
+| Command | What it does |
+|---|---|
+| `init` | Creates `.env.example` if missing, adds `.env` to `.gitignore` |
+| `check` | Diffs `.env` vs `.env.example`, flags real secrets accidentally left in the example file, confirms `.env` is git-ignored |
+| `sync` | Rewrites `.env.example` from `.env`'s keys with placeholder values — your real secrets never touch the example file |
+| `scan` | Walks the repo looking for AWS keys, GitHub/Slack tokens, Stripe live keys, private key blocks, JWTs, and suspicious `KEY=value` pairs |
+
+Exit codes are non-zero on any issue found, so it's a one-line addition to CI or a pre-commit hook:
+
+```yaml
+# .github/workflows/tests.yml
+- run: pip install env-sentry && env-sentry check && env-sentry scan
+```
+
+```bash
+# pre-commit hook
+env-sentry scan || exit 1
+```
+
+---
+
+## Why not just use `git-secrets` / `truffleHog` / `detect-secrets`?
+
+Those are great, heavier tools for deep git-history scanning. `env-sentry` is intentionally small: it's the **5-second daily check**, not a security audit platform. No config file, no dependencies, no setup — just an honest answer to "did I mess up my `.env` today?"
+
+---
+
+## Contributing
+
+Issues and PRs welcome. The whole tool is a single ~250 line file (`env_sentry/cli.py`) on purpose — keep it that way.
+
+## License
+
+MIT

env_sentry-0.1.0/README.md

@@ -0,0 +1,105 @@
+# 🛡️ env-sentry
+
+**Stop leaking secrets in `.env` files. Zero dependencies, one command.**
+
+[![PyPI](https://img.shields.io/badge/pip%20install-env--sentry-blue)](https://pypi.org/project/env-sentry/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org)
+[![Zero Dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](pyproject.toml)
+
+Every project with a `.env` file eventually has one of these moments:
+
+- Someone's `.env` isn't in `.gitignore` and real secrets get pushed to GitHub.
+- `.env.example` drifts out of sync, and a new teammate spends 20 minutes figuring out which env vars they're missing.
+- A Stripe key or AWS credential gets hardcoded "just for testing" and never gets cleaned up.
+
+`env-sentry` is a tiny CLI that catches all three, in one command, with **no dependencies to install**.
+
+---
+
+## Install
+
+```bash
+pip install env-sentry
+```
+
+## Quick start
+
+```bash
+# Scaffold .env.example and make sure .env is git-ignored
+env-sentry init
+
+# Compare .env against .env.example, flag drift and leaked secrets
+env-sentry check
+
+# Regenerate .env.example from .env (values are redacted, never copied)
+env-sentry sync
+
+# Scan the whole repo for hardcoded API keys, tokens, and private keys
+env-sentry scan
+```
+
+### Example output
+
+```
+$ env-sentry check
+
+❌ Keys in .env but missing from .env.example:
+   - STRIPE_SECRET_KEY
+   - DATABASE_URL
+
+🚨 .env.example may contain REAL secret values, not placeholders:
+   - OLD_API_KEY
+
+🚨 '.env' does not appear to be listed in .gitignore!
+   Anyone who commits will leak real secrets. Run `env-sentry init` to fix this.
+```
+
+```
+$ env-sentry scan
+
+config.py:14  AWS Access Key
+config.py:14  Suspicious value for 'AWS_SECRET'
+notes.txt:3   GitHub Token
+
+🚨 3 potential secret(s) found. Review before committing/pushing.
+```
+
+---
+
+## What it checks for
+
+| Command | What it does |
+|---|---|
+| `init` | Creates `.env.example` if missing, adds `.env` to `.gitignore` |
+| `check` | Diffs `.env` vs `.env.example`, flags real secrets accidentally left in the example file, confirms `.env` is git-ignored |
+| `sync` | Rewrites `.env.example` from `.env`'s keys with placeholder values — your real secrets never touch the example file |
+| `scan` | Walks the repo looking for AWS keys, GitHub/Slack tokens, Stripe live keys, private key blocks, JWTs, and suspicious `KEY=value` pairs |
+
+Exit codes are non-zero on any issue found, so it's a one-line addition to CI or a pre-commit hook:
+
+```yaml
+# .github/workflows/tests.yml
+- run: pip install env-sentry && env-sentry check && env-sentry scan
+```
+
+```bash
+# pre-commit hook
+env-sentry scan || exit 1
+```
+
+---
+
+## Why not just use `git-secrets` / `truffleHog` / `detect-secrets`?
+
+Those are great, heavier tools for deep git-history scanning. `env-sentry` is intentionally small: it's the **5-second daily check**, not a security audit platform. No config file, no dependencies, no setup — just an honest answer to "did I mess up my `.env` today?"
+
+---
+
+## Contributing
+
+Issues and PRs welcome. The whole tool is a single ~250 line file (`env_sentry/cli.py`) on purpose — keep it that way.
+
+## License
+
+MIT

env_sentry-0.1.0/env_sentry/__init__.py

@@ -0,0 +1,3 @@
+from .cli import main  # noqa: F401
+
+__version__ = "0.1.0"

env_sentry-0.1.0/env_sentry/cli.py

@@ -0,0 +1,316 @@
+"""
+env-sentry
+A tiny, zero-dependency CLI that keeps your .env setup safe and sane.
+
+Commands:
+    env-sentry init    Scaffold .env.example and make sure .env is git-ignored
+    env-sentry check   Compare .env against .env.example and flag drift
+    env-sentry sync    Regenerate .env.example from .env (values redacted)
+    env-sentry scan    Walk the repo looking for hardcoded secrets
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import sys
+from pathlib import Path
+
+VERSION = "0.1.0"
+
+# ----------------------------------------------------------------------
+# .env parsing helpers
+# ----------------------------------------------------------------------
+
+_KV_RE = re.compile(r"""^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$""")
+
+
+def parse_env_file(path: Path) -> dict[str, str]:
+    """Parse a .env-style file into a dict of key -> raw value string."""
+    values: dict[str, str] = {}
+    if not path.exists():
+        return values
+    for line in path.read_text(errors="ignore").splitlines():
+        stripped = line.strip()
+        if not stripped or stripped.startswith("#"):
+            continue
+        match = _KV_RE.match(line)
+        if not match:
+            continue
+        key, val = match.group(1), match.group(2).strip()
+        if len(val) >= 2 and val[0] == val[-1] and val[0] in ("'", '"'):
+            val = val[1:-1]
+        values[key] = val
+    return values
+
+
+# ----------------------------------------------------------------------
+# check / sync / init
+# ----------------------------------------------------------------------
+
+def cmd_check(args: argparse.Namespace) -> int:
+    env_path = Path(args.env)
+    example_path = Path(args.example)
+
+    env_vars = parse_env_file(env_path)
+    example_vars = parse_env_file(example_path)
+
+    exit_code = 0
+
+    if not env_path.exists():
+        print(f"⚠️  {env_path} not found (nothing to compare against).")
+    if not example_path.exists():
+        print(f"⚠️  {example_path} not found. Run `env-sentry sync` to create it.")
+        exit_code = 1
+
+    missing_in_example = sorted(set(env_vars) - set(example_vars))
+    missing_in_env = sorted(set(example_vars) - set(env_vars))
+
+    if missing_in_example:
+        exit_code = 1
+        print(f"\n❌ Keys in {env_path} but missing from {example_path}:")
+        for key in missing_in_example:
+            print(f"   - {key}")
+
+    if missing_in_env:
+        print(f"\nℹ️  Keys in {example_path} but not set in {env_path}:")
+        for key in missing_in_env:
+            print(f"   - {key}")
+
+    # Warn if .env.example contains what looks like a real secret
+    suspicious = [k for k, v in example_vars.items() if looks_like_secret(k, v)]
+    if suspicious:
+        exit_code = 1
+        print(f"\n🚨 {example_path} may contain REAL secret values, not placeholders:")
+        for key in suspicious:
+            print(f"   - {key}")
+        print("   Replace these with placeholders like `your_api_key_here` before committing.")
+
+    # Warn if .env is not gitignored
+    if not is_gitignored(".env"):
+        exit_code = 1
+        print(f"\n🚨 '.env' does not appear to be listed in .gitignore!")
+        print("   Anyone who commits will leak real secrets. Run `env-sentry init` to fix this.")
+
+    if exit_code == 0:
+        print("✅ .env and .env.example are in sync. .env is git-ignored. Looking good.")
+
+    return exit_code
+
+
+def cmd_sync(args: argparse.Namespace) -> int:
+    env_path = Path(args.env)
+    example_path = Path(args.example)
+
+    if not env_path.exists():
+        print(f"❌ {env_path} not found, nothing to sync from.")
+        return 1
+
+    env_vars = parse_env_file(env_path)
+    lines = ["# Auto-generated by env-sentry — fill in real values in your own .env\n"]
+    for key in env_vars:
+        lines.append(f"{key}=your_{key.lower()}_here\n")
+
+    example_path.write_text("".join(lines))
+    print(f"✅ Wrote {len(env_vars)} placeholder keys to {example_path}")
+    return 0
+
+
+def cmd_init(args: argparse.Namespace) -> int:
+    exit_code = 0
+    example_path = Path(args.example)
+    if not example_path.exists():
+        example_path.write_text("# Copy this file to .env and fill in real values\n")
+        print(f"✅ Created {example_path}")
+    else:
+        print(f"ℹ️  {example_path} already exists, leaving it alone.")
+
+    gitignore_path = Path(".gitignore")
+    if not is_gitignored(".env"):
+        with gitignore_path.open("a") as f:
+            f.write("\n.env\n")
+        print("✅ Added '.env' to .gitignore")
+    else:
+        print("ℹ️  '.env' is already git-ignored.")
+
+    return exit_code
+
+
+def is_gitignored(name: str) -> bool:
+    gitignore_path = Path(".gitignore")
+    if not gitignore_path.exists():
+        return False
+    patterns = [p.strip() for p in gitignore_path.read_text().splitlines()]
+    return name in patterns or f"/{name}" in patterns or "*.env" in patterns
+
+
+# ----------------------------------------------------------------------
+# secret detection
+# ----------------------------------------------------------------------
+
+SECRET_KEY_HINTS = re.compile(
+    r"(secret|token|api[_-]?key|password|passwd|access[_-]?key|private[_-]?key|"
+    r"auth|credential|client[_-]?secret)",
+    re.IGNORECASE,
+)
+
+PLACEHOLDER_RE = re.compile(
+    r"^(your|my|example|placeholder|xxx+|changeme|todo|<.*>|\$\{.*\}|test|fake|dummy)",
+    re.IGNORECASE,
+)
+
+# Well-known secret formats worth flagging outright.
+KNOWN_PATTERNS = {
+    "AWS Access Key": re.compile(r"AKIA[0-9A-Z]{16}"),
+    "GitHub Token": re.compile(r"gh[pousr]_[A-Za-z0-9]{36,}"),
+    "Slack Token": re.compile(r"xox[baprs]-[A-Za-z0-9-]{10,}"),
+    "Stripe Key": re.compile(r"sk_live_[A-Za-z0-9]{20,}"),
+    "Private Key Block": re.compile(r"-----BEGIN (RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----"),
+    "Generic JWT": re.compile(r"eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}"),
+}
+
+DEFAULT_IGNORE_DIRS = {
+    ".git", "node_modules", "venv", ".venv", "__pycache__", "dist", "build",
+    ".mypy_cache", ".pytest_cache", "target", ".next", ".tox", "vendor",
+}
+
+SCANNABLE_EXTENSIONS = {
+    ".py", ".js", ".ts", ".jsx", ".tsx", ".env", ".yml", ".yaml", ".json",
+    ".toml", ".ini", ".cfg", ".sh", ".rb", ".go", ".java", ".php", ".txt",
+    ".properties", ".conf",
+}
+
+
+def looks_like_secret(key: str, value: str) -> bool:
+    if not value or PLACEHOLDER_RE.match(value):
+        return False
+    if len(value) < 12:
+        return False
+    if not SECRET_KEY_HINTS.search(key):
+        return False
+    return True
+
+
+def scan_line(line: str) -> list[str]:
+    findings = []
+    for name, pattern in KNOWN_PATTERNS.items():
+        if pattern.search(line):
+            findings.append(name)
+    match = _KV_RE.match(line)
+    if match:
+        key, val = match.group(1), match.group(2).strip().strip("'\"")
+        if looks_like_secret(key, val):
+            findings.append(f"Suspicious value for '{key}'")
+    return findings
+
+
+def cmd_scan(args: argparse.Namespace) -> int:
+    root = Path(args.path)
+    total_findings = 0
+
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in DEFAULT_IGNORE_DIRS and not d.startswith(".git")]
+        for filename in filenames:
+            file_path = Path(dirpath) / filename
+            if file_path.suffix not in SCANNABLE_EXTENSIONS and filename != ".env":
+                continue
+            try:
+                lines = file_path.read_text(errors="ignore").splitlines()
+            except (UnicodeDecodeError, OSError):
+                continue
+            for lineno, line in enumerate(lines, start=1):
+                findings = scan_line(line)
+                for finding in findings:
+                    total_findings += 1
+                    print(f"{file_path}:{lineno}  {finding}")
+
+    if total_findings == 0:
+        print("✅ No obvious hardcoded secrets found.")
+        return 0
+    else:
+        print(f"\n🚨 {total_findings} potential secret(s) found. Review before committing/pushing.")
+        return 1
+
+
+# ----------------------------------------------------------------------
+# entrypoint
+# ----------------------------------------------------------------------
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="env-sentry",
+        description="Keep your .env setup safe and in sync. Zero dependencies.",
+    )
+    parser.add_argument("--version", action="version", version=f"env-sentry {VERSION}")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    p_init = subparsers.add_parser(
+        "init",
+        help="Scaffold .env.example and git-ignore .env",
+        description="Create .env.example if it doesn't exist yet, and make sure "
+        "'.env' is listed in .gitignore so real secrets never get committed.",
+    )
+    p_init.add_argument(
+        "--example", default=".env.example",
+        help="Path to the example file to create (default: .env.example)",
+    )
+    p_init.set_defaults(func=cmd_init)
+
+    p_check = subparsers.add_parser(
+        "check",
+        help="Compare .env against .env.example",
+        description="Diff .env against .env.example, flag any real secret values "
+        "left in the example file, and confirm .env is git-ignored. "
+        "Exits non-zero if anything looks wrong (safe to use in CI).",
+    )
+    p_check.add_argument(
+        "--env", default=".env",
+        help="Path to your real env file (default: .env)",
+    )
+    p_check.add_argument(
+        "--example", default=".env.example",
+        help="Path to the example/template file to compare against (default: .env.example)",
+    )
+    p_check.set_defaults(func=cmd_check)
+
+    p_sync = subparsers.add_parser(
+        "sync",
+        help="Regenerate .env.example from .env (values redacted)",
+        description="Rewrite .env.example using the keys from .env, but with every "
+        "value replaced by a placeholder — your real secrets are never copied.",
+    )
+    p_sync.add_argument(
+        "--env", default=".env",
+        help="Path to your real env file to read keys from (default: .env)",
+    )
+    p_sync.add_argument(
+        "--example", default=".env.example",
+        help="Path to the example file to write (default: .env.example)",
+    )
+    p_sync.set_defaults(func=cmd_sync)
+
+    p_scan = subparsers.add_parser(
+        "scan",
+        help="Scan the repo for hardcoded secrets",
+        description="Recursively scan source files for AWS/GitHub/Slack/Stripe keys, "
+        "private key blocks, JWTs, and suspicious KEY=value pairs. "
+        "Exits non-zero if anything is found (safe to use as a pre-commit hook).",
+    )
+    p_scan.add_argument(
+        "path", nargs="?", default=".",
+        help="Directory to scan (default: current directory)",
+    )
+    p_scan.set_defaults(func=cmd_scan)
+
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

env_sentry-0.1.0/env_sentry.egg-info/PKG-INFO

@@ -0,0 +1,125 @@
+Metadata-Version: 2.4
+Name: env-sentry
+Version: 0.1.0
+Summary: A tiny, zero-dependency CLI that keeps your .env setup safe and in sync.
+Author: nour yahyaoui
+License: MIT
+Project-URL: Homepage, https://github.com/nour-yahyaoui/env-sentry
+Project-URL: Issues, https://github.com/nour-yahyaoui/env-sentry/issues
+Keywords: env,dotenv,security,secrets,cli,devtools
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Build Tools
+Classifier: Topic :: Security
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# 🛡️ env-sentry
+
+**Stop leaking secrets in `.env` files. Zero dependencies, one command.**
+
+[![PyPI](https://img.shields.io/badge/pip%20install-env--sentry-blue)](https://pypi.org/project/env-sentry/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org)
+[![Zero Dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](pyproject.toml)
+
+Every project with a `.env` file eventually has one of these moments:
+
+- Someone's `.env` isn't in `.gitignore` and real secrets get pushed to GitHub.
+- `.env.example` drifts out of sync, and a new teammate spends 20 minutes figuring out which env vars they're missing.
+- A Stripe key or AWS credential gets hardcoded "just for testing" and never gets cleaned up.
+
+`env-sentry` is a tiny CLI that catches all three, in one command, with **no dependencies to install**.
+
+---
+
+## Install
+
+```bash
+pip install env-sentry
+```
+
+## Quick start
+
+```bash
+# Scaffold .env.example and make sure .env is git-ignored
+env-sentry init
+
+# Compare .env against .env.example, flag drift and leaked secrets
+env-sentry check
+
+# Regenerate .env.example from .env (values are redacted, never copied)
+env-sentry sync
+
+# Scan the whole repo for hardcoded API keys, tokens, and private keys
+env-sentry scan
+```
+
+### Example output
+
+```
+$ env-sentry check
+
+❌ Keys in .env but missing from .env.example:
+   - STRIPE_SECRET_KEY
+   - DATABASE_URL
+
+🚨 .env.example may contain REAL secret values, not placeholders:
+   - OLD_API_KEY
+
+🚨 '.env' does not appear to be listed in .gitignore!
+   Anyone who commits will leak real secrets. Run `env-sentry init` to fix this.
+```
+
+```
+$ env-sentry scan
+
+config.py:14  AWS Access Key
+config.py:14  Suspicious value for 'AWS_SECRET'
+notes.txt:3   GitHub Token
+
+🚨 3 potential secret(s) found. Review before committing/pushing.
+```
+
+---
+
+## What it checks for
+
+| Command | What it does |
+|---|---|
+| `init` | Creates `.env.example` if missing, adds `.env` to `.gitignore` |
+| `check` | Diffs `.env` vs `.env.example`, flags real secrets accidentally left in the example file, confirms `.env` is git-ignored |
+| `sync` | Rewrites `.env.example` from `.env`'s keys with placeholder values — your real secrets never touch the example file |
+| `scan` | Walks the repo looking for AWS keys, GitHub/Slack tokens, Stripe live keys, private key blocks, JWTs, and suspicious `KEY=value` pairs |
+
+Exit codes are non-zero on any issue found, so it's a one-line addition to CI or a pre-commit hook:
+
+```yaml
+# .github/workflows/tests.yml
+- run: pip install env-sentry && env-sentry check && env-sentry scan
+```
+
+```bash
+# pre-commit hook
+env-sentry scan || exit 1
+```
+
+---
+
+## Why not just use `git-secrets` / `truffleHog` / `detect-secrets`?
+
+Those are great, heavier tools for deep git-history scanning. `env-sentry` is intentionally small: it's the **5-second daily check**, not a security audit platform. No config file, no dependencies, no setup — just an honest answer to "did I mess up my `.env` today?"
+
+---
+
+## Contributing
+
+Issues and PRs welcome. The whole tool is a single ~250 line file (`env_sentry/cli.py`) on purpose — keep it that way.
+
+## License
+
+MIT

env_sentry-0.1.0/env_sentry.egg-info/SOURCES.txt

@@ -0,0 +1,11 @@
+LICENSE
+README.md
+pyproject.toml
+env_sentry/__init__.py
+env_sentry/cli.py
+env_sentry.egg-info/PKG-INFO
+env_sentry.egg-info/SOURCES.txt
+env_sentry.egg-info/dependency_links.txt
+env_sentry.egg-info/entry_points.txt
+env_sentry.egg-info/top_level.txt
+tests/test_basic.py

env_sentry-0.1.0/env_sentry.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

env_sentry-0.1.0/env_sentry.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+env-sentry = env_sentry.cli:main

env_sentry-0.1.0/env_sentry.egg-info/top_level.txt

@@ -0,0 +1 @@
+env_sentry

env_sentry-0.1.0/pyproject.toml

@@ -0,0 +1,31 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "env-sentry"
+version = "0.1.0"
+description = "A tiny, zero-dependency CLI that keeps your .env setup safe and in sync."
+readme = "README.md"
+requires-python = ">=3.8"
+license = { text = "MIT" }
+authors = [{ name = "nour yahyaoui" }]
+keywords = ["env", "dotenv", "security", "secrets", "cli", "devtools"]
+classifiers = [
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Software Development :: Build Tools",
+    "Topic :: Security",
+]
+
+[project.urls]
+Homepage = "https://github.com/nour-yahyaoui/env-sentry"
+Issues = "https://github.com/nour-yahyaoui/env-sentry/issues"
+
+[project.scripts]
+env-sentry = "env_sentry.cli:main"
+
+[tool.setuptools]
+packages = ["env_sentry"]

env_sentry-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

env_sentry-0.1.0/tests/test_basic.py

@@ -0,0 +1,44 @@
+import subprocess
+import sys
+from pathlib import Path
+
+
+def run(args, cwd):
+    return subprocess.run(
+        [sys.executable, "-m", "env_sentry.cli", *args],
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+    )
+
+
+def test_init_and_check(tmp_path: Path):
+    (tmp_path / ".env").write_text("API_KEY=abc123\nDEBUG=true\n")
+
+    result = run(["init"], cwd=tmp_path)
+    assert "Created" in result.stdout or ".env.example" in result.stdout
+
+    result = run(["sync"], cwd=tmp_path)
+    assert result.returncode == 0
+
+    result = run(["check"], cwd=tmp_path)
+    assert result.returncode == 0
+    assert "in sync" in result.stdout
+
+
+def test_check_flags_missing_key(tmp_path: Path):
+    (tmp_path / ".env").write_text("API_KEY=abc123\nEXTRA_KEY=zzz\n")
+    (tmp_path / ".env.example").write_text("API_KEY=your_api_key_here\n")
+    (tmp_path / ".gitignore").write_text(".env\n")
+
+    result = run(["check"], cwd=tmp_path)
+    assert result.returncode == 1
+    assert "EXTRA_KEY" in result.stdout
+
+
+def test_scan_detects_known_pattern(tmp_path: Path):
+    (tmp_path / "config.py").write_text('AWS_KEY = "AKIAABCDEFGHIJKLMNOP"\n')
+
+    result = run(["scan", "."], cwd=tmp_path)
+    assert result.returncode == 1
+    assert "AWS Access Key" in result.stdout