Environment files

mint guard env checks environment files and their relationship with git. It is separate from the general text scan because the useful questions are structural: is this file tracked, would it be committed, and does the project document its variables?

mint guard env [path] [--format text|json|sarif|markdown]

What it checks#

Rule	Severity	Finding
`env-file-tracked`	critical	An env file is tracked by git, so it is in the repository history
`env-file-not-ignored`	high	An untracked env file is not ignored and could be added accidentally
`env-no-example`	low	Env files exist but no example file does

Env files match .env and .env.<name> for names made of letters, digits, _ and -. Example files are:

.env.example
.env.sample
.env.template
.env.dist
.env.defaults

.env.example itself is not treated as a secret-bearing env file.

Contents are scanned too#

For tracked or unignored env files, mint guard env also scans the file contents with the normal rule set and entropy detector. Example files are scanned too because a real-looking value in .env.example is often a real credential copied by mistake. Findings in example files that would be low severity are raised to high.

The scan also reports a missing .env.example when at least one env file exists.

If the directory is not inside a git repository, or git is unavailable, the tracked and ignored checks are skipped and the report includes a note.

Flags#

Flag	Effect
`--fail-on <severity>`	Exit 1 at or above this severity. Default `medium`
`--format <name>`	`text`, `json`, `sarif` or `markdown`
`--no-baseline`	Do not load the baseline
`--baseline-file <path>`	Baseline path
`--config <path>`	Config path
`--quiet`	Suppress progress output

--entropy-threshold is accepted by scan but not by env; the configured threshold still applies.

Example#

$ mint guard env
mint guard · env scan

! 2 findings (1 critical, 1 high)
  3 env files checked · 0.01s

CRITICAL env-file-tracked   .env.local
         .env tracked by git
         preview: ***
         fix: mint token --bytes 32

HIGH     github-token       .env.local:4
         GitHub token
         preview: ghp_...9f
         fix: mint token --bytes 32

Keep it clean#

# .gitignore
.env
.env.*
!.env.example

Commit an .env.example with placeholders, not values:

# .env.example
DATABASE_URL=<your-database-url>
JWT_SECRET=<generate-with-mint>

The scanner never prints the full value of a finding. Deleting a value from the current file does not remove it from history; rotate it.