Environment Variable Inventory Checker

Environment label:

This traceable label appears in evidence and remediation exports.

Required variables:

Accepts names, KEY=, KEY: value, export KEY=value, and declare -x KEY=value rows.

Source format:

Auto detect reports the resolved parser in the summary and evidence rows.

Current inventory:

Use a capture from the exact deployment environment being reviewed.

Blank required values:

Blocking blanks is safer for ordinary deployment readiness checks.

Variable matching:

Keep exact matching for runtime configuration unless casing is presentation-only.

Allowed extra prefixes:

Useful for intentional public build-time families such as NEXT_PUBLIC_ and VITE_.

Placeholder tokens:

Tune the release policy for local sample values such as changeme or replace_me.

Sensitive name tokens:

This changes risk flags only; actual values stay redacted.

Flag lowercase names:

Flags naming drift without changing required-name coverage.

Evidence package name:

Leave blank to use the environment label in exported evidence.

Show JSON handoff:

Adds redacted Copy JSON and Download JSON actions to Requirement Audit without adding a JSON result tab.

Variable	Status	Value state	Source	Detail	Copy
{{ row.variable }}	{{ row.status }}	{{ row.value_state }}	{{ row.source }}	{{ row.detail }}

Variable	Required	Value state	Source lines	Flags	Copy
{{ row.variable }}	{{ row.required }}	{{ row.value_state }}	{{ row.source_lines }}	{{ row.flags }}

Severity	Check	Evidence	Next action	Copy
{{ row.severity }}	{{ row.check }}	{{ row.evidence }}	{{ row.next_action }}

{{ remediationStub }}

An environment-variable inventory answers a release question that source code alone cannot settle: does this exact deployment have the configuration names the application expects? Staging can pass while production fails because one variable is missing, blank, misspelled, defined twice, or still contains a sample value.

The required list is a contract of names. The current inventory is evidence from a shell, env file, deployment manifest, or exported configuration. Comparing them is more reliable than reading either list alone because a variable can exist without being usable, and an apparently complete inventory can contain unrelated or risky extras.

Missing: No parsed definition matches the required name.
Empty: The effective definition has no value. Some applications accept this deliberately, while others fail at startup or silently use a fallback.
Placeholder: The value matches a configured sample token or a placeholder form such as ${NAME} or <value>.
Reference: A manifest points to another configuration or secret source. The reference counts as present, but its target is not resolved.
Duplicate: More than one definition maps to the same name. The last parsed definition determines this audit's value state, which may not match every runtime's precedence rules.

Case matters in most deployment environments. DATABASE_URL and database_url are normally different names, so exact matching is the safer default. Case-insensitive comparison is useful only when casing is presentation noise in the source being audited.

Names that resemble secrets deserve careful handling, but a name-based warning cannot tell whether the value is genuine, current, encrypted, or safely injected. Likewise, a non-empty value proves presence rather than correctness. A database URL can be syntactically present and still point to the wrong host.

Capture the inventory from the deployment environment under review and keep the capture time and environment label with the result. Configuration can differ between shells, containers, build jobs, service managers, and running processes because each inherits or injects variables through a different path.

How to Use This Tool:

Compare one traceable deployment environment with the required-name list for the same application version.

Enter an Environment label and paste the Required variables. Names, KEY=, KEY: value, export KEY=value, and declare -x KEY=value rows are accepted; values on required rows are ignored.
Paste or load the Current inventory from the exact deployment being reviewed. Choose ENV, JSON, or YAML explicitly when auto-detection selects the wrong parser.
Keep exact matching and blocking blanks for ordinary release checks. Change these only when the target runtime or application deliberately treats case or empty strings differently.
Tune allowed extra prefixes, placeholder tokens, and sensitive-name tokens to the deployment policy. Allowed prefixes exempt intentional public families such as NEXT_PUBLIC_ or VITE_ from extra-variable review.
Resolve missing, blank, and placeholder required variables first, then inspect duplicate, extra, sensitive-name, lowercase, and parser warnings. Re-capture the environment after remediation instead of editing the evidence to look clean.

Interpreting Results:

Required inventory ready means every required name is set or represented by a reference and no review item remains. Inventory needs review means coverage has no blocking group but at least one warning or review group remains. Deployment blockers found means at least one missing-variable group exists or blank required values are blocking under the selected policy.

Coverage counts required variables in Set or Reference states. Placeholder and empty values do not contribute.
A Reference counts as covered because a named source exists, not because the referenced value was fetched or validated.
The blocker and warning figures count grouped briefing entries, while Missing, Empty, Placeholder, Duplicate, and Extra figures count variables.
A sensitive-name warning says the variable name contains one of the active tokens and has a set value. It does not expose or validate that value.
Parser warnings can make an apparently high percentage incomplete. Correct unsupported rows before using the result as deployment evidence.

Technical Details:

The audit converts the required list and current inventory into canonical variable-name records, groups inventory definitions by name, classifies the last definition in each group, then applies release-policy warnings. Values are used for classification in memory but are replaced by state labels, source positions, flags, and character counts in the evidence.

Transformation Core

Environment inventory parsing paths
Source	Accepted shape	Important behavior
Required names	Portable variable names with optional list marker, `export`, `declare -x`, assignment, colon, comma, or trailing text.	Only names are retained. Repeated required names produce a warning and the first occurrence remains the requirement row.
ENV or shell rows	One `KEY=value` definition per non-comment line, with optional `export` or `declare -x`.	Quoted outer values are unwrapped; whitespace-led inline comments are removed outside quotes.
JSON	Objects or arrays containing scalar variable keys, `name` and `value` rows, or `name` and `valueFrom` rows.	Nested objects and arrays are walked recursively. A `valueFrom` row becomes a Reference.
YAML	Simple variable mappings and common `name` with `value` or `valueFrom` manifest rows.	This is a bounded line parser rather than a complete YAML implementation; unsupported lines can produce warnings.
Auto detect	Leading JSON delimiters, common YAML structures, or otherwise ENV rows.	The resolved parser is reported so the reader can catch a mistaken format choice.

Rule Core

Environment variable inventory classification rules
Condition	Result	Effect
No matching definition	Missing	Creates a blocker briefing group.
Last definition is empty	Empty	Creates a blocker when blank policy is Block; otherwise creates a Review group.
Last definition is a placeholder	Placeholder	Creates a Warning group. Exact token matches, token substrings, `${...}`, angle-bracket placeholders, and null-like words are recognized.
Last definition is an external reference	Reference	Counts as covered without resolving the target.
Several definitions share one canonical name	Present duplicate or duplicate flag	Creates a Warning group; the last parsed definition determines Set, Reference, Empty, or Placeholder state.
Inventory name is not required	Extra	Creates a Review group unless the name begins with an allowed extra prefix.
Set name contains a sensitive token	Sensitive-name flag	Creates a Review group while keeping the value redacted.
Name contains lowercase letters	Lowercase-name flag	Creates a Warning group only when lowercase warnings are enabled.

Formula Core

Ready variables are required names whose effective state is Set or Reference. Coverage retains calculation precision and is displayed to one decimal place.

C = \frac{N_{set} + N_{reference}}{N_{required}} \times 100 %

Each required and inventory source is limited to 262,144 characters. Policy fields are limited to 4,000 characters, required variables to 5,000, and parsed inventory definitions to 10,000. Variable names must match [A-Za-z_][A-Za-z0-9_]*.

Limitations and Privacy Notes:

Pasted text and loaded files are parsed in the current browser. Actual values are not included in requirement, inventory, chart, remediation, or JSON handoff evidence; set values are represented by state and length. The audit does not read a running process, resolve secret or config references, test credentials, apply platform-specific precedence, or prove that a value belongs to the intended environment. Treat the source capture itself as sensitive and keep raw inventories out of tickets and version control.

References:

Store config in the environment, The Twelve-Factor App.
Secrets Management Cheat Sheet, OWASP Cheat Sheet Series.
How to set environment variables in Linux, Simplified Guide.
How to use an env file with Docker Compose, Simplified Guide.