dotenv-diff scans your codebase for environment variable usage and checks it against your env files.
This document focuses on one question: what does the scanner actually check for?
The tool recognises the following patterns:
// Node.js – dot and bracket notation
process.env.MY_KEY
process.env["MY_KEY"]
process.env['MY_KEY']
// Node.js – destructuring
const { MY_KEY } = process.env
const { MY_KEY: alias, OTHER_KEY = "fallback" } = process.env
// Vite / import.meta
import.meta.env.MY_KEY
import.meta.env["MY_KEY"]
import.meta.env['MY_KEY']
// SvelteKit – dynamic (env object)
import { env } from '$env/dynamic/private';
import { env } from '$env/dynamic/public';
env.MY_KEY
const { MY_KEY } = env
const { MY_KEY: alias, OTHER_KEY = "fallback" } = env
// SvelteKit – static (named imports)
import { MY_KEY } from '$env/static/private';
import { MY_KEY } from '$env/static/public';
MY_KEYNote: The scanner skips files containing any line over 500 characters, as these are likely minified or bundled — this avoids false positives across all checks below.
Which files are scanned is determined by the file scanning configuration (see configuration and flags).
Variables that are used in code but not defined in the selected env comparison file.
Variables that are defined in env files but never used in the scanned codebase.
Duplicate variable definitions inside env files (both main env and example env, when available).
Potential secrets and sensitive values, including high-risk patterns.
Potential secrets found in .env.example content.
Framework-aware warnings (for supported frameworks) around unsafe or incorrect env usage patterns.
Variables that do not follow conventional uppercase env naming style.
Variables that appear to use mixed or conflicting naming patterns.
Cases where environment-related values are logged with console.log.
Warnings for environment values that look like expiring tokens/credentials or contain expiration metadata.
Checks whether .env is properly ignored by .gitignore.
A final score based on scan findings (missing, unused, duplicates, security warnings, and more).