dennisonbertram/go-code/dotenv-audit

# Check if .env is in .gitignore
grep -n "\.env" .gitignore 2>/dev/null || echo "CRITICAL: .env not in .gitignore"
 
# Check all .env variants
for pattern in ".env" ".env.*" "*.env"; do
  grep -q "$pattern" .gitignore && echo "OK: $pattern is ignored" \
    || echo "WARNING: $pattern not found in .gitignore"
done

# Check if any .env files are tracked by git
git ls-files | grep -E "\.env$|\.env\." | head -20
 
# Check git history for .env files
git log --all --full-history -- "*.env" "**/.env" ".env" 2>/dev/null | head -20

# Remove from tracking without deleting the local file
git rm --cached .env
git rm --cached .env.local
 
# Add to .gitignore
echo ".env" >> .gitignore
echo ".env.*" >> .gitignore
 
# Commit the removal
git commit -m "Remove .env from tracking, add to .gitignore"

# Scan for common API key patterns
grep -rn --include="*.go" \
  -E "(api[_-]?key|secret|password|token|credential)\s*=\s*['\"][A-Za-z0-9+/]{16,}" \
  . | grep -v "_test.go" | grep -v "vendor/"
 
# Scan for specific key prefixes
grep -rn --include="*.go" \
  -E "(sk-[A-Za-z0-9]{32,}|ghp_[A-Za-z0-9]{36}|AKIA[A-Z0-9]{16})" \
  . | grep -v "_test.go"
 
# Check for Base64-encoded secrets (common obfuscation)
grep -rn --include="*.go" \
  -E "['\"][A-Za-z0-9+/]{40,}={0,2}['\"]" \
  . | grep -v "_test.go" | head -20

# Check for .env.example
ls -la .env.example 2>/dev/null || echo "WARNING: .env.example is missing"

# Example .env.example content
cat > .env.example << 'EOF'
# Required: OpenAI API key
OPENAI_API_KEY=your-api-key-here
 
# Required: Server address
HARNESS_ADDR=:8080
 
# Optional: Default model
HARNESS_MODEL=gpt-4.1-mini
EOF

# Extract all os.Getenv calls from Go code
grep -rn --include="*.go" 'os\.Getenv(' . | \
  grep -oE '"[A-Z_]+"' | sort -u | tr -d '"'

# Extract keys from .env.example
grep -v '^#' .env.example | grep '=' | cut -d= -f1 | sort -u

# Look for potential secret interpolation in log statements
grep -rn --include="*.go" \
  -E '(log\.|fmt\.Print|fmt\.Sprintf).*(key|secret|token|password)' \
  . | grep -v "_test.go"

// WRONG
log.Printf("connecting with key=%s", apiKey)
 
// CORRECT
log.Printf("connecting with key=%s...", apiKey[:8])

DOTENV AUDIT RESULTS
====================
[ ] .env in .gitignore
[ ] No .env files tracked by git
[ ] No hardcoded secrets in source
[ ] .env.example exists
[ ] All os.Getenv vars documented in .env.example
[ ] No secrets in log statements