Env example lists every variable the code reads

What this means

Passing means every variable your code reads through process.env appears in a committed .env.example with a placeholder value. Failing means at least one variable the code depends on is listed nowhere, so a fresh clone, a new teammate or a new hosting project starts without it. A missing .env.example fails outright.

How we test it

This is a local check. You run npx securealy scan-repo on your own machine; it collects every process.env.NAME reference in your source outside node_modules and compares the names to the ones in .env.example. Every name present is a pass. Any name missing, or no example file at all, is a fail. Nothing leaves the machine.

Why it matters

Missing variables are the first deploy-day failure. A build that reads a variable nobody set fails, and on Vercel a failed build means the previous deployment keeps serving, so you debug code that is not even live. The example file is also the only place a new environment learns what it needs. Keep it to placeholders: a keyword-monitoring product once shipped a .env.staging.template whose JWT_SECRET was a real value, readable at the domain root, enough to forge a session for any user.

The fix

List every process.env.NAME the code reads with the grep from the Module 00 runbook, and add each missing name to .env.example with an ALL_CAPS placeholder, never a real-looking value. Keep the negation line that re-includes .env.example below the .env.* line in .gitignore so the example is committed while the real file stays ignored.

The full runbook is in the Fix Kit, Module 00.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change any file. Run this and show me the output:
grep -rhoE "process\.env\.[A-Z0-9_]+" --include='*.js' --include='*.ts' --include='*.tsx' --include='*.mjs' --exclude-dir=node_modules --exclude-dir=.next . | sort -u
Then print the variable names in .env.example, or say the file does not exist.
List every name the code reads that .env.example does not contain.
Run: grep -cE "=.*(live|secret|key)[A-Za-z0-9]{20,}" .env.example and show the count. Anything above 0 is a real-looking value in a committed file.
Tell me what it would take to bring the example to parity, and stop there.
Finally run: git check-ignore .env.example; echo "exit=$?" and show me the result. Expected exit=1, meaning the example is committed, not ignored.