Flag environment-named files without reading their values

By Batu · English technical notes

Also published in our Blogger archive.

Direct answer

Filename-only environment scanning begins with directory entries, not file reads. Path.iterdir() supplies names, so the example can flag .env and .env.production while its two sentinel assertions prove that neither stored value reaches the report. That is a regression boundary: a later refactor which reads the files and interpolates content into stdout would fail the test. A matching name is not proof that it contains a secret, and an unmatched name is not proof that the tree is safe. The example does not recurse, classify templates, follow symlinks, or redact data another subsystem already loaded. Keep the observation narrowly named as a filename signal.

Complete example

from pathlib import Path
from tempfile import TemporaryDirectory

with TemporaryDirectory() as directory:
    root = Path(directory)
    (root / ".env").write_text("TOKEN=do-not-print", encoding="utf-8")
    (root / ".env.production").write_text("KEY=also-hidden", encoding="utf-8")
    names = sorted(item.name for item in root.iterdir() if item.name.startswith(".env"))
    report = f"environment_files={','.join(names)} values_read=no"
    assert "do-not-print" not in report
    assert "also-hidden" not in report
    print(report)

Expected stdout:

environment_files=.env,.env.production values_read=no

Sources

- pathlib documentation

Prepared with AI assistance. The example uses synthetic data; its stated limits apply.