
Security News
Rust RFC Proposes a Security Tab on crates.io for RustSec Advisories
Rustâs crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.
Fast .env linter for humans and CI. Validate and lint .env files; emit SARIF for CI.
Fast .env linter and fixer for humans and CI
env-genie makes sure your .env files are clean, consistent, and production-ready. It detects common mistakes, compares against .env.example, and can output results in human-friendly, JSON, or SARIF formats for CI pipelines.
=.env.example--fix (BOM, trailing spaces, CRLF â LF)--json for scripts/CI--sarif for GitHub code scanningcommander + picocolorsInstall globally:
npm install -g env-genie
Or run with npx:
npx env-genie .env
quick try
npx env-genie
local dev dependency
npm i -D env-genie
npx env-genie
# scan default .env in text mode
npx env-genie
# write SARIF for GitHub Code Scanning
npx env-genie --sarif env-genie.sarif
# JSON for scripting
npx env-genie --json | jq '.findings | length'
# multiple files
npx env-genie --path .env --path apps/web/.env.local
name: env-lint
on: [push, pull_request]
jobs:
lint-env:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
- run: npx env-genie --sarif env-genie.sarif
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: env-genie.sarif
Usage: env-genie [options] [file]
Arguments:
file Path to .env file (default: ./.env)
Options:
-e, --example <file> Compare against .env.example
--json JSON output
--sarif [file] Output findings in SARIF format (optional file path)
--fix Auto-fix safe issues (BOM removal, trailing spaces, LF)
-h, --help Show help
# Check .env and compare against .env.example
npx env-genie -e .env.example
# Output JSON
npx env-genie --json
# Output SARIF (GitHub code scanning)
npx env-genie --sarif
# Auto-fix safe issues
npx env-genie --fix
npx env-genie # check ./.env
npx env-genie .env.local # check a specific file
npx env-genie --example .env.example
npx env-genie --json
npx env-genie --fix # safe autofixes (BOM, trailing spaces, LF)
# in CI:
- run: npx env-genie --example .env.example
## CI Integration
`env-genie` works great in GitHub Actions. Example:
```yaml
- name: Lint env
run: npx env-genie --sarif env-genie.sarif || true
FAQs
Fast .env linter for humans and CI. Validate and lint .env files; emit SARIF for CI.
We found that env-genie demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Rustâs crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.

Security News
/Research
Socket found a Rust typosquat (finch-rust) that loads sha-rust to steal credentials, using impersonation and an unpinned dependency to auto-deliver updates.

Research
/Security Fundamentals
A pair of typosquatted Go packages posing as Googleâs UUID library quietly turn helper functions into encrypted exfiltration channels to a paste site, putting developer and CI data at risk.