Risk Analysis

// From src/core/analyzer.ts:99-129
function calculateRiskScore(variable: EnvVariable): number {
    let score = 0;

    // Critical: Used but never defined anywhere and no default
    if (variable.usedInCode && !variable.definedInEnvFile && !variable.hasDefault) {
        score += 5;
    }

    // High: Defined in .env but not in .env.example (potential secret leak)
    if (variable.definedInEnvFile && !variable.definedInExample && looksLikeSecret(variable.name)) {
        score += 4;
    }

    // Medium: Used in multiple files with no default
    if (variable.usedInCode && variable.usages.length > 2 && !variable.hasDefault) {
        score += 3;
    }

    // Low: Not documented
    if (!variable.isDocumented && variable.usedInCode) {
        score += 1;
    }

    // Low: Dead variable (defined but never used)
    if (variable.definedInEnvFile && !variable.usedInCode) {
        score += 1;
    }

    return Math.min(score, 5);
}

// From src/core/analyzer.ts:134-140
function scoreToRiskLevel(score: number): RiskLevel {
    if (score >= 5) return 'critical';
    if (score >= 4) return 'high';
    if (score >= 3) return 'medium';
    if (score >= 1) return 'low';
    return 'info';
}

// From src/core/analyzer.ts:50-60
const SECRET_PATTERNS = [
    /SECRET/i,
    /PASSWORD/i,
    /PASS$/i,
    /TOKEN/i,
    /KEY$/i,
    /API_KEY/i,
    /PRIVATE/i,
    /CREDENTIAL/i,
    /AUTH/i,
];

function looksLikeSecret(name: string): boolean {
    return SECRET_PATTERNS.some(pattern => pattern.test(name));
}

# Analyze all variables
envark risk

# Filter by minimum risk level
envark risk --min-level high
envark risk --min-level critical

# In interactive mode
/risk
r

┌─ RISK ANALYSIS ───────────────────────────────────────────┐
│  Critical: 2  High: 5  Medium: 12  Low: 23
└──────────────────────────────────────────────────────────┘

  ⚠ DATABASE_PASSWORD [CRITICAL]
    → Used in code but not defined in any .env file
    → Add DATABASE_PASSWORD to your .env file or provide a default value

  ⚠ SECRET_KEY [HIGH]
    → Looks like a secret but is in a potentially committed .env file
    → Move SECRET_KEY to .env.local or ensure .env is in .gitignore

  ⚠ API_URL [MEDIUM]
    → Has different values across .env files
    → .env: "https://prod.example.com"
    → .env.local: "http://localhost:3000"

// From src/core/analyzer.ts:34-47
export interface AnalysisResult {
    variables: AnalyzedVariable[];
    summary: {
        totalVariables: number;
        critical: number;
        high: number;
        medium: number;
        low: number;
        info: number;
        byIssueType: Record<IssueType, number>;
    };
    duplicateGroups: Map<string, Array<{ file: string; value: string }>>;
    similarNameGroups: Map<string, string[]>;
}

// From src/core/analyzer.ts:263-292
function generateRecommendations(variable: EnvVariable, issues: Issue[]): string[] {
    const recommendations: string[] = [];

    // Add unique recommendations from issues
    for (const issue of issues) {
        recommendations.push(issue.recommendation);
    }

    // Add general recommendations
    if (variable.usedInCode && variable.usages.length > 3 && !variable.hasDefault) {
        recommendations.push(
            `Consider creating a config module that validates ${variable.name} at startup`
        );
    }

    if (variable.languages.length > 1) {
        recommendations.push(
            `${variable.name} is used across ${variable.languages.join(', ')} - ensure consistent handling`
        );
    }

    return recommendations;
}

// From src/core/analyzer.ts:370-377
export function filterByRisk(
    result: AnalysisResult,
    minRisk: RiskLevel
): AnalyzedVariable[] {
    const riskOrder: Record<RiskLevel, number> = { 
        critical: 5, high: 4, medium: 3, low: 2, info: 1 
    };
    const minScore = riskOrder[minRisk];
    return result.variables.filter(v => riskOrder[v.riskLevel] >= minScore);
}

// From src/core/analyzer.ts:383-387
export function filterByIssueType(
    result: AnalysisResult,
    issueType: IssueType
): AnalyzedVariable[] {
    return result.variables.filter(v => 
        v.issues.some(i => i.type === issueType)
    );
}

# Get AI analysis
envark analyze

# Or in TUI
/analyze
an

# .github/workflows/env-check.yml
name: Environment Variable Check

on: [push, pull_request]

jobs:
  envark:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Install Envark
        run: npm install -g envark
      - name: Run Risk Analysis
        run: envark risk --min-level high --fail-on-issues

import { scanProject } from 'envark';
import { resolveEnvMap } from 'envark/core/resolver';
import { analyzeEnvVariables, filterByRisk } from 'envark/core/analyzer';

const scan = scanProject('/path/to/project');
const resolved = resolveEnvMap(scan.usages);
const analysis = analyzeEnvVariables(resolved);

// Get critical issues
const critical = filterByRisk(analysis, 'critical');

if (critical.length > 0) {
    console.error(`Found ${critical.length} critical issues!`);
    process.exit(1);
}