ENV guide
Prevent Configuration Drift Across Dev, Staging, and Production
Configuration drift happens when environments stop sharing the same variable contract. The values should differ, but missing keys, stale names, and undocumented overrides create deployments that behave unpredictably.
Compare the contract, not the secrets
Treat variable names, required presence, and expected format as the contract. Keep actual values in the secret store for each environment. Comparing key sets reveals drift without requiring production credentials to be copied into local files.
When values must be reviewed, mask them by default and reveal only the specific comparison needed. Differences such as DEBUG=false in production may be correct; unexplained missing keys are the higher-risk signal.
Use explicit precedence
Layered configuration is easier to reason about when precedence is written down: shared defaults first, environment overrides second, and runtime secrets last. Avoid merging files when nobody can state which source wins a conflict.
shared.env < staging.env < runtime secret store shared.env < production.env < runtime secret store
Review drift as part of delivery
Add a key-set comparison to release preparation or CI. Require documentation for new variables and remove old variables from code, templates, and deployment configuration in the same change.
- Keep one reviewed .env.example as the public contract.
- Compare every environment against that contract before release.
- Resolve missing variables through the secret manager, not chat or tickets.
- Record intentional environment-only keys so they do not become permanent mystery state.
Apply the guide privately
EnvSift processes ENV content locally in your browser and does not send keys or values to a server.
Compare environments