Audit Local Environment File Access
Find local environment files that hold secrets, identify who can read them, and check that builds do not copy them into artifacts.
A local environment file can be convenient for development and dangerous when it moves into a container image, build cache, support bundle, or shared home directory. The review is not a search for real key values. It is a map of where secrets can be read and copied.
List the approved development and build paths. Include the application root, shell environment, IDE tasks, Docker build context, test artifacts, and backup locations. OWASP's secrets guidance recommends limiting storage and access. GitHub's workflow guidance also warns that logs and workflow contexts can expose sensitive values.
File-location inventory
| Location | Reader | Risk check |
|---|---|---|
Local .env file | Developer account | File permissions and sync rules |
| Build context | Container builder | Exclusion from copied layers |
| Test snapshot | CI runner | No secret value in fixture |
| Client bundle | Browser user | No server credential embedded |
| Backup | Recovery operator | Retention and access policy |
| Support archive | Support recipient | Redaction before transfer |
Use synthetic markers to test copy paths. A source file excluded from Git may still enter a Docker image through COPY ., a browser bundle through a build-time variable, or a crash report. Check generated artifacts after a build, not just source control status. Do not run an unrestricted scan of personal files or unrelated repositories.
Owned build test
Place a fake credential marker in the approved local secret path. Build the application in an isolated environment. Inspect the output bundle, container layers or archive, source maps, logs, and test reports for that marker. Record the paths checked and the result. Confirm the application still starts when it reads the secret through its intended server-side channel.
If a real key is found in an output, stop distributing that artifact and follow the provider-side rotation process. Deleting the file or changing .gitignore does not revoke a copied key. Keep the inventory as safe metadata: path class, owner, access rule, and cleanup action, never the value. Recheck when build tooling or deployment layout changes. To verify artifact isolation, inspect the built output and deployment environment directly; a workflow record alone is insufficient.
Make offboarding verifiable
Use the offboarding checklist to identify owners, revoke grants and verify the result. Discuss a scoped review of your application's access controls.