Environment Scanning

The envpkt env scan command auto-discovers credentials from your shell by matching environment variable names and values against a registry of known patterns.

Discovery Workflow

1. Scan — iterate over all env vars in process.env
2. Exclude — skip known non-credential vars (PATH, HOME, NODE_ENV, etc.)
3. Match — test each var against three pattern tiers
4. Score — assign a confidence level based on match quality
5. Report — display results sorted by confidence (high first)

Three Pattern Tiers

Tier 1: Exact Name (~45 patterns)

Known service-specific variable names matched with high confidence:

| Variable | Service | | ------------------- | -------- | | OPENAI_API_KEY | openai | | AWS_ACCESS_KEY_ID | aws | | STRIPE_SECRET_KEY | stripe | | GITHUB_TOKEN | github | | DATABASE_URL | database | | SUPABASE_ANON_KEY | supabase | | DD_API_KEY | datadog |

And ~38 more covering Anthropic, Azure, GCP, Slack, Twilio, SendGrid, Sentry, Vercel, Netlify, Cloudflare, Docker, npm, Hugging Face, Cohere, Replicate, Pinecone, Linear, MongoDB, Redis.

Tier 2: Value Shape (~29 patterns)

Recognized value prefixes matched with high confidence:

| Prefix | Service | | ---------------------- | ---------- | | sk-ant- | anthropic | | sk- | openai | | sk_live_, sk_test_ | stripe | | AKIA | aws | | ghp_, gho_, ghs_ | github | | xoxb-, xoxp- | slack | | postgres:// | postgresql | | redis:// | redis | | mongodb:// | mongodb |

Tier 3: Generic Suffix (~13 patterns)

Common credential suffixes matched with medium confidence:

_API_KEY, _SECRET_KEY, _SECRET, _TOKEN, _PASSWORD, _PASS, _AUTH_TOKEN, _ACCESS_TOKEN, _PRIVATE_KEY, _SIGNING_KEY, _WEBHOOK_SECRET, _DSN, _CONNECTION_STRING

The service name is derived by stripping the suffix and lowercasing (e.g., ACME_API_KEY → acme).

Confidence Scoring

| Level | Icon | When | | ---------- | ---- | ------------------------------------------- | | High | ● | Exact name match or recognized value prefix | | Medium | ◐ | Generic suffix pattern with derived service |

Scaffolding

Convert scan results to envpkt.toml:

# Preview what would be written
envpkt env scan --dry-run

# Write to envpkt.toml
envpkt env scan --write

Drift Detection

After scaffolding, use envpkt env check for ongoing monitoring:

envpkt env check

This detects:

• TOML keys missing from env — secrets defined but not set
• Untracked env vars — credential-shaped vars not in TOML