Skip to the main content
{}

Open-source Laravel tool

Laravel Env Guard

Composer package that automatically checks Laravel projects during development for missing, unused, duplicate or inconsistent environment keys and unsafe env() usage.

View on GitHub(Opens in a new window)Discuss safe Laravel configuration

When should you use this tool?

Use this package as a development guard when multiple .env files, Laravel configuration, Vite or test environments share environment contracts and mistakes should surface before deployment.

On guarded Artisan boots the current project state is analysed again, risky environment access and key drift are reported, and environment values stay out of findings, console output and logs.

Who is this tool for? Laravel teams that want to catch environment drift and configuration-cache problems early without logging secret values or relying on a separate audit command.

Quickstart

Local installation

Use the repository as a starting point. Always verify your own project requirements and lockfiles before production use.

composer require --dev codegenie-be/laravel-env-guard

Key capabilities

  • 01Detects env() and Illuminate\Support\Env::get() outside config/, including dynamic and direct environment access
  • 02Compares automatically discovered plaintext .env and .env.* files for key drift without requiring .env.example
  • 03Reports missing, possibly unused, duplicate and case-inconsistent environment keys
  • 04Understands Laravel 12 and 13, .env.testing, phpunit.xml, Vite import.meta.env and loadEnv()
  • 05Runs local and console-first by default so normal HTTP requests do not continuously perform a full source audit
  • 06Reports keys and locations only; environment values and secrets are excluded from findings

Example: a missing key

Synthetic example: the active .env declares DEMO_SERVICE_KEY while .env.testing does not. The guard can report this difference in keys. The following description simplifies the finding; it is not literal output from an executed scan.

text
DEMO_SERVICE_KEY: missing from .env.testing
Check whether the key is deliberately optional.

Assessing a finding

  • The default check is local and console-oriented. It compares existing plaintext environment files and analyses source; a specifically named .env.example is not required.
  • Key names and source locations are diagnostic information. Do not publish secret values to explain a finding.
  • An apparently unused key may be used indirectly by an integration. Investigate before deleting configuration.
  • The tool does not replace checks of authorisation, production settings or provider credentials. Test the cached application after a change.
Read why configuration caching needs an explicit contract

Another useful Laravel resource

Laravel Livewire Multi-step Form

Open source

Open-source Composer package for Laravel 12/13 and Livewire 3.6+/4: a configurable multi-step form with validation, a review step and a controlled submission hook.

Laravel teams integrating multi-step forms without handing application persistence to a package.

View the toolGitHub(Opens in a new window)

Adapt a tool to your own Laravel project?

Codegenie can tailor the flow, styling, validation or deployment to your existing application.

Discuss your project