Dotenv files resemble shell scripts but are not a universal shell language. This parser recognizes common assignments, export prefixes, quoted values, blank lines, and comments without interpolation or execution.
Duplicate keys remain in source order and are flagged because consumers may choose first-wins or last-wins behavior. Invalid lines are reported instead of silently discarded.
Credential-shaped keys such as TOKEN, PASSWORD, SECRET, and API_KEY have their values redacted in parsed output and findings, preventing the result card from repeating a pasted secret.
Edge cases worth knowing
- Quoted values
- Quoted values may contain spaces and comment characters; outer quotes are removed without evaluating variables.
- Duplicate assignments
- Every assignment is retained. The parser warns rather than guessing which value a library keeps.
- Shell syntax
- Command substitution and arbitrary shell statements are not executed and are reported as invalid when they are not assignments.
Common mistakes
- Committing a .env file containing production credentials.
- Assuming every dotenv library implements quoting and duplicates identically.
- Treating .env text as a shell script and executing untrusted content.
- Logging parsed configuration objects containing passwords or API tokens.