Developer tools
A command-line tool that finds the same secret in two environments (staging and production) and secrets still equal to the .env.example value or a placeholder, and also tracks how long each secret has gone unchanged, without ever printing a value. It still compares .env.example with your real files by key name.
Coming soon
Not published on its store yet, so there is no buy or download link. PN Scripts does not take payment for it here.
The gap
A staging copy of a production secret, a changeme that reached production and a database password nobody has rotated in two years are the env-file problems that become incidents, and the usual way to find them is to open the files, which puts secrets on screens and in logs.
What it is
Keytally compares secret values between your env files inside its own memory and reports only key names and line numbers; as a supporting check it keeps a ledger of salted hashes outside the project to tell how long each secret has gone unchanged.
How you use it
Know which secrets are shared, unfinished or overdue for rotation without a single value reaching a screen or a log.
Env checkers mostly ask whether a key exists or whether a value looks weak inside one file. Keytally compares the secrets themselves across your files: the same value in staging and production, a value copied from .env.example, and, as a supporting check, how long it has gone unchanged.
Use it when
Built for
keytally reuse takes the .env files of the folder, or the files you name, and the example file for comparison. A secret value found in two files is an error, because a leak of staging then opens production. A placeholder such as changeme or <your-key>, or a value still equal to the one in .env.example, is an error. One value behind two keys of a file and a secret under eight characters are warnings. Secrets are picked out by key name (PASSWORD, TOKEN, SECRET, API_KEY and similar, but not PUBLIC_KEY or SITE_KEY) and by long random-looking or URL-embedded values.
keytally seal stores a salted PBKDF2 hash of each secret and the date it first appeared. A changed value starts a new clock; an unchanged one keeps its date. keytally age then fails when a secret has not changed for --max-age days (90 by default), notes values that changed but were not sealed and secrets not yet in the ledger, and exits with 1 so a scheduled CI job can nag. The ledger lives in your cache folder with mode 0600 and is not meant for version control; hashes of short or guessable secrets can be guessed by whoever steals the file, which is why weak secrets are reported separately.
Values are held in memory only while the files are compared. Findings contain key names, file names and line numbers, and broken lines are described by fixed messages. A test runs reuse, seal and age in every output format over files full of marker values and fails if a marker appears in the output or in the ledger file.
keytally .env.example .env.staging reports missing, extra, empty and duplicate keys and invalid lines with line numbers and a hint for a likely typo, in text, JSON or GitHub annotations. --strict, --ignore and the empty-value switches decide what fails the run.
This file could not be loaded.
This file could not be loaded.
This file could not be loaded.
This file could not be loaded.
This file could not be loaded.
This file could not be loaded.
This file could not be loaded.
This file could not be loaded.
1 of 8
| Platform or runtime | Supported versions | Tested up to |
|---|---|---|
| Linux amd64 | kernel 3.2 (Go 1.26 minimum) or newer | Ubuntu 24.04, kernel 6.8 |
| Linux arm64 | kernel 3.2 (Go 1.26 minimum) or newer | built, not run |
| macOS arm64 | macOS 12 (Go 1.26 minimum) or newer | built, not run |
| Windows amd64 | Windows 10 (Go 1.26 minimum) or newer | built, not run |
It is finished and tested. It is not on sale yet; this page will say where to get it when it is.
Coming soon
Not published on its store yet, so there is no buy or download link. PN Scripts does not take payment for it here.
