env-shield

A VS Code extension that catches .env files and other secret-shaped files before they ever reach GitHub — at commit time, whether you commit from the Source Control panel or the terminal — and retroactively across your git history.

Why this exists

Leaked credentials are almost never caused by a bad actor — they're caused by an ordinary git add . on a Friday afternoon, after a .env file was created for local testing and quietly forgotten. .gitignore only protects you if the entry was added before the file was ever staged; once a secret lands in a commit, it stays in the repository's history even if you delete it in the next commit. GitHub's own secret scanning catches some of this after the fact, but by then the key has already been pushed to a remote you don't fully control.

env-shield moves the check earlier with two independent layers, so a slip past one doesn't mean a slip all the way to GitHub:

• Git-level (unbypassable): a .git/hooks/pre-commit hook that blocks a matching commit outright — from the Source Control panel, the integrated terminal, or any external git client. It's installed automatically the moment you open a git repo with env-shield active, and it appends to (never clobbers) a pre-commit hook you already have.
• Editor-level (convenient): an env-shield: Commit (with secret check) command, next to the native commit button, that checks your staged files first and shows an interactive warning before the commit happens.

A separate, on-demand Repository Health check looks at the two things a pre-commit hook can't: whether a sensitive file was ever committed to history (even if it's since been deleted), and whether the repo has any GitHub Actions secrets configured.

What it catches

Any staged file whose filename or full path matches a glob in env-shield.patterns — by default:

.env  .env.*  *.pem  *.key  id_rsa  id_rsa.pub  id_ed25519  credentials.json  *.pfx  *.p12

Templates meant to be committed (.env.example, .env.sample, .env.template) are excluded by default via env-shield.ignorePatterns. Both lists are fully configurable per-project.

Screenshot

TODO: add a screenshot/GIF of the warning dialog firing on a staged .env file.

Install

env-shield isn't published to the Marketplace yet. To run it from source:

git clone https://github.com/Marshmallow-Projects/env-shield.git
cd env-shield
npm install

Then open the folder in VS Code and press F5 (or Run > Start Debugging) to launch an Extension Development Host with env-shield loaded.

To package a local .vsix you can install permanently:

npm install -g @vscode/vsce
vsce package
code --install-extension env-shield-0.0.1.vsix

Usage

Open the Command Palette (Cmd+Shift+P / Ctrl+Shift+P) and run one of:

Command	What it does
env-shield: Commit (with secret check)	Checks staged files for sensitive patterns, then commits (also available as a button in the Source Control title bar)
env-shield: Install Git Hook	(Normally automatic) installs/updates the .git/hooks/pre-commit block
env-shield: Uninstall Git Hook	Removes only the env-shield block from the hook, leaving any other hook logic intact
env-shield: Check Repository Health	Scans full git history for ever-committed secrets and checks GitHub Actions secrets configuration; also runs once automatically, in the background, on your first commit each session

When a warning fires, you get three choices:

1. Add to .gitignore & Unstage — appends the file to .gitignore (creating it if needed) and runs git rm --cached so it's untracked but untouched on disk. You commit the .gitignore change yourself when ready.
2. Ignore and Commit Anyway — requires a second, explicit confirmation, then commits as normal. Each use is logged to the env-shield output channel and nudges a "N ignored warnings this session" counter in the status bar tooltip.
3. Cancel — aborts; nothing is staged, unstaged, or modified.

The status bar shield icon reflects whether the pre-commit hook is currently active for this workspace, and can be clicked to run a Repository Health check.

Settings

Setting	Default	Description
env-shield.patterns	see above	Glob patterns (matched against filename and full staged path) that mark a file as sensitive
env-shield.ignorePatterns	.env.example, .env.sample, .env.template	Glob patterns always allowed, even if they also match env-shield.patterns
env-shield.enableGitHubChecks	true	Enables the GitHub Actions secrets check as part of Repository Health
env-shield.enablePreCommitHook	true	Installs the .git/hooks/pre-commit block automatically on activation

Patterns containing characters outside A-Z a-z 0-9 _ . - * ? / are accepted by the Source Control check but are skipped in the generated shell hook (logged to the output channel) — this keeps the hook script safe from injection via untrusted workspace settings.

Development

npm run check-types   # tsc --noEmit
npm run lint          # eslint
npm test              # compiles and runs the mocha suite in an Extension Development Host

CI runs all three on every pull request (see .github/workflows/ci.yml).

License

MIT — see LICENSE.