GitHub
Releases
Code quality
Security & compliance
Env & config hygiene
Whether a new environment can be brought up from the repo alone.
Overview
A cross-read of the environment variables your code actually uses against the ones your repo documents, plus the config values that were pasted in as literals instead.
What it looks for
- No .env.example in a repo that reads environment variables
- Config values hardcoded instead of read from the environment
- Variables used in code but absent from .env.example
- Production config files carrying literal values
Why it matters
Config drift is where onboarding stalls and staging diverges from production. A value hardcoded in a config file is a value that cannot differ per environment, and often a credential that cannot be rotated without a deploy.
Rules in this check
| What it reports | Fix path |
|---|---|
| Missing .env.example | Pull request |
| Config value hardcoded instead of env var | Guide |
| Env vars used in code but missing from .env.example | Pull request |
| Production config file with hardcoded values | Guide |
How the fixes arrive
Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.