.env validator

Under the Hood: The Architecture of Corporate .env File Environment Syntax Validator

A production .env is a keyring: database URLs, signing secrets, third-party API tokens. Upload-based dotenv linters and “env comparators” that store files in a project workspace are credential-adjacent products. The market already understands this—privacy-first .env validators advertise browser-only parsing. This page is that class of tool: a secure environment checker that never POSTs the buffer.

Validation is syntax and structure, not runtime injection. The checker does not eval, does not spawn a shell, and does not interpolate nested $VAR expansions against process.env. It reports missing equals, empty keys, illegal identifiers, unclosed quotes, and duplicate keys. Duplicate-key detection is the high-intent feature because many dotenv implementations last-write-wins silently, which is how a staging URL overwrites production in a merged file.

Memory Allocation & Browser Threading Mechanics

Optional file load uses TextDecoder on arrayBuffer(). The live path is a controlled textarea whose value is validated in useMemo on every keystroke. split(/\r?\n/) plus forEach is linear in line count. A Map<string, lineNumber> stores first occurrence of each key. Issue objects are small. A 100 KB env file is trivial; no Worker is warranted, and a Worker would structured-clone the secrets into another heap—worse for a shared machine dump.

Algorithmic Deep-Dive: Code Snippet & Logical Analysis

function validateEnv(input) {
  const issues = [];
  const keys = new Map();
  input.split(/\r?\n/).forEach((raw, i) => {
    const n = i + 1;
    const line = raw.trim();
    if (!line || line.startsWith("#")) return;
    const eq = line.indexOf("=");
    if (eq === -1) { issues.push({ n, msg: "Missing '='" }); return; }
    let key = line.slice(0, eq).trim();
    if (key.startsWith("export ")) key = key.slice(7).trim();
    const value = line.slice(eq + 1);
    if (!key) issues.push({ n, msg: "Empty key" });
    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) issues.push({ n, msg: "Invalid key" });
    if ((value.startsWith('"') && !value.endsWith('"')) ||
        (value.startsWith("'") && !value.endsWith("'"))) {
      issues.push({ n, msg: "Unclosed quote" });
    }
    if (keys.has(key)) issues.push({ n, msg: "Duplicate of line " + keys.get(key) });
    else keys.set(key, n);
  });
  return issues;
}

export KEY=value is accepted because some generators emit it. Values are not unquoted or interpreted, so a value containing = is fine. Blank and comment lines are ignored. Identifier regex matches POSIX-ish env names used by dotenv. The tool does not try to be a YAML parser for .env.example tables.

The Local Storage Sandbox & Volatile Data Pipelines

There is no download of a “validation report” by default, because reports tend to echo values. Issues render as line-numbered messages in the DOM. The textarea is the sole store. No localStorage autosave—autosave would be the worst feature on a secrets form. Closing the tab drops the heap.

Verifying True Privacy: How to Audit Your Browser's Network Tab

F12 → Network → clear. Paste AWS_SECRET_ACCESS_KEY=AKIA_EXAMPLE. Use the Network search box for AKIA_EXAMPLE. Zero hits in request payloads is the pass criterion. If a third-party script beacons the page URL only, that is still not your secret—but this validator’s code path never includes a submit.