Skip to content
One Agent a DayIn → agent → out
MenuClose

Swipe right for a newer agent, Webhook Contract Writer. Swipe left for an older agent, Tone Lock Replies.

Issue 25 · 29 Sep 2026 · Medium · Free

Env Var Auditor

The example file and the code drifted apart, and you cannot tell which key the app will demand at boot.

Paste .env.example and the code that reads it. Get missing keys, unused keys, and names that look like live secrets.

Category
Coding & Vibe Coding
Runs in
Cursor
Claude
ChatGPT
Tags
Vibe Coding
Env
Security

What you put in and what you get out

Sample you can paste

.env.example
PORT=3000
DATABASE_URL=postgres://localhost/ledger
STRIPE_SECRET_KEY=sk_live_replace_me

Code:
const port = process.env.PORT ?? "3000";
const db = process.env.DATABASE_URL;
if (!db) throw new Error("DATABASE_URL is required");
const stripe = process.env.STRIPE_SECRET_KEY;
const region = process.env.FLY_REGION;

Nobody reads FLY_REGION in the paste. The example contains a value that starts with sk_live_. I have not committed a real key. Tell me if the example is unsafe anyway.
Read the promptDownload .txt

Share this agent

Env Var Auditor — You put in .env.example. You get out The fix. Free from One Agent a Day.

Share on XShare on LinkedIn

30-second demo

0:00

The drift

PORT and DATABASE_URL are read. DATABASE_URL is required. FLY_REGION is read and missing from the example.

How it works

The auditor compares two pastes: the example file and the lines that read environment variables. A key the code requires and the example hides will break the next boot. A key in the example that nothing reads is how secrets linger. A value that looks like a live credential does not belong in an example, even when you believe it is fake.

It does not need the real secret and should not be given one. It will not tell you how to use a leaked key. It tells you to rotate if a live-looking value was committed, and it shows the placeholder shape.

Update the example in the same commit as the code that reads the new name. Drift is how this list comes back.

Use it

  1. Step 1

    Paste the example and the reads

    Copy .env.example and the lines that read process.env or the equivalent. Redact any real secret first; leave the name. A placeholder is fine.

  2. Step 2

    Paste the prompt

    You get three lists: required by code and missing from the example, present in the example and unread, and names whose values look like live credentials.

  3. Step 3

    Fix the example, not the secret store

    Add the missing key with an obvious fake value. Remove or comment the unused key. Replace any live-looking value with a placeholder like sk_test_replace_me.

  4. Step 4

    Do not paste a rotated secret back into chat

    If a real key was in the file, rotate it in the provider. The auditor's job is the drift. It does not need the secret to finish.

Prompt

env-var-auditor.prompt.txt

Download
You compare an env example file to the code that reads env vars. You flag drift and live-looking placeholders. You do not ask for real secrets and you do not explain how to abuse a key.

INPUTS
- The example file.
- The lines that read env vars, with enough context to see a required check.

RULES
- Missing: read by code, absent from the example. Mark required if the code throws or refuses to boot without it.
- Unused: in the example, not read in the paste. Say the paste may be incomplete rather than claiming the key is dead in the whole repo.
- Live-looking: values that use a live prefix (sk_live_, rk_live_, AKIA, a private key header, a real-looking connection string with a password). Tell them to replace with an obvious fake. Do not repeat the secret; repeat the name and the prefix only.
- Do not invent keys.
- Do not provide exploit steps for a leaked key. The remediation is: rotate in the provider, then replace the example.
- If they pasted a real-looking full key, tell them to rotate and do not echo the value.

OUTPUT
## Missing
## Unused
## Live-looking
## Example lines to change
Name and a safe placeholder.

## Rotate
Yes or no, and which name. No values.

Config

env-var-auditor.defaults.json

Download
{
  "version": 1,
  "livePrefixes": [
    "sk_live_",
    "rk_live_",
    "AKIA",
    "-----BEGIN"
  ],
  "echoSecretValues": false,
  "exploitSteps": false
}
Was this useful?

A yes or no is enough. The note stays on this server's log.

Related agents

Swipe sideways

  1. Coding & Vibe Coding15 Oct 2026 · #41Session HandoffPaste the mess from a coding session. Get a handoff note: what shipped, what is broken, and the exact prompt to paste tomorrow.InBranch: feat/billing-uiOutTomorrow's first promptEasy
    Preview this drop
    1. 0:00 The swampBranch feat/billing-ui. Auth works. Billing page half done. Stripe webhook returns 400. Receipt email never fires.
    2. 0:08 What actually shippedLogin on staging, pricing table render, stripe package installed. Plan change is still a stub. PayPal left alone on purpose.
    3. 0:16 What is brokenWebhook 400, missing signature check, BillingForm customerId null, receipt email not wired. Ranked by what blocks the rest.
    4. 0:24 Tomorrow's first promptA paste-ready prompt that starts at the webhook 400, forbids touching PayPal, and asks for a signature check plus a failing test.

    No daily video for this drop yet. The in and out lines above are the preview.

  2. Coding & Vibe Coding11 Oct 2026 · #37Vibe-code Security CheckerA review prompt for vibe-coded diffs. It hunts secrets, missing auth, injection, and insecure defaults, then names the fix.InStack: Next.js route handler, TypeScript, Postgres via a query string.OutWhat it will not doMedium
    Preview this drop
    1. 0:00 The diff that 'works'A Next.js DELETE handler reads an id from JSON, concatenates it into SQL, and returns a live-looking secret key in the response.
    2. 0:08 What it should catchA secret in source. SQL built with string concatenation. No check that this caller owns the note. The key echoed back to the client.
    3. 0:16 Severity, then the fixHigh: move the key to an environment variable and rotate it. High: parameterize the query. High: derive the user from the session and filter the delete by owner.
    4. 0:24 What it will not doIt will not hand you a working exploit. The sample key is fake. The output is the safer handler, not a payload.

    No daily video for this drop yet. The in and out lines above are the preview.

  3. Coding & Vibe Coding17 Sep 2026 · #13Test Plan from the PromptPaste the prompt you used to vibe-code a feature. Get the checks to run before merge, including the case that prompt forgot.InPrompt I gave Cursor:OutLaterMedium
    Preview this drop
    1. 0:00 The original promptA refund button for paid orders under 7 days, a POST, and a success toast. No failure, no double click, no permissions.
    2. 0:08 The forgotten casesA 500 from the API, a second click, an order already refunded, and a viewer who is not allowed to refund.
    3. 0:16 Before mergeThree checks: the happy path you asked for, the failed POST does not say Refunded, and a double click does not send two POSTs.
    4. 0:24 LaterThe 7-day boundary and the hidden button are listed as follow-ups, not pretended to be done.

    No daily video for this drop yet. The in and out lines above are the preview.

Tomorrow's drop

Get tomorrow's agent in your inbox

One email when the drop goes up. No digest, no course. Unsubscribe whenever the provider lets you.

Pro and custom

€9/month when Pro opens

Early look at the next drop, a better archive, and the occasional agent that does not fit the public mix. The daily agent stays free. A custom build is €49–199. Nothing is charged from this form.

Join the Pro waitlist

Tomorrow's drop

Get the daily agent

One email when the drop goes up. The same list as the signup on the page.