Env & Secrets Manager

Complete environment variable and secrets management lifecycle: .env file structure across dev/staging/production, .env.example auto-generation that strips sensitive values, required-variable validation at startup, secret leak detection in git history, credential rotation playbooks, environment drift detection, and integration with HashiCorp Vault, AWS SSM, 1Password CLI, and Doppler.

Core Capabilities

• .env lifecycle — structured layout with categorized sections, auto-generated .env.example (strips secrets), environment-specific files, and fail-fast startup validation.
• Secret leak detection — regex scan of git history, working tree, and staged files; pre-commit hooks; patterns for API keys, tokens, passwords, private keys.
• Credential rotation — per-secret playbooks, scope analysis, zero-downtime dual-read rotation, post-rotation verification and monitoring.
• Secret manager integration — HashiCorp Vault (KV v2 + OIDC), AWS SSM Parameter Store (KMS), 1Password CLI (template injection), Doppler (project/config).
• Drift detection — compare variable key sets between staging and production and report missing/extra keys.

When to Use

• Setting up a new project — scaffold .env.example and validation.
• Before every commit — scan for accidentally staged secrets.
• Post-incident — rotate leaked credentials systematically.
• Onboarding developers — provide complete environment setup.
• Auditing — detect environment drift between staging and production.
• Compliance — demonstrate secret management practices.