# @secretlint/secretlint-rule-no-dotenv

> A secretlint rule for dotenv

Latest version **13.0.5** (published 2026-08-27) · MIT license · 0 weekly downloads

## Install

```sh
npm install @secretlint/secretlint-rule-no-dotenv
pnpm add @secretlint/secretlint-rule-no-dotenv
yarn add @secretlint/secretlint-rule-no-dotenv
bun add @secretlint/secretlint-rule-no-dotenv
```

## Health

**Score 75/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 13.0.5 |
| Published | 2026-08-27 |
| First published | 2020-04-04 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=22.0.0 |
| Dependencies | 1 |
| Unpacked size | 9.3 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 1449 |
| Author | Munieru |
| Maintainers | azu |
| Keywords | secretlint, rule, dotenv |

## Links

- npm: https://www.npmjs.com/package/@secretlint/secretlint-rule-no-dotenv
- Repository: https://github.com/secretlint/secretlint
- Homepage: https://github.com/secretlint/secretlint/tree/master/packages/@secretlint/secretlint-rule-no-dotenv/
- Issues: https://github.com/secretlint/secretlint/issues
- npm.io page: https://npm.io/package/@secretlint/secretlint-rule-no-dotenv

## Dependencies (1)

- [@secretlint/types](https://npm.io/package/@secretlint/types.md) 13.0.5

## Alternatives

- [jsforce](https://npm.io/package/jsforce.md) — 851.2K weekly downloads
- [react-native-qrcode-svg](https://npm.io/package/react-native-qrcode-svg.md) — 693.5K weekly downloads
- [@salesforce/plugin-data](https://npm.io/package/@salesforce/plugin-data.md) — 394.9K weekly downloads
- [@backstage/plugin-search-common](https://npm.io/package/@backstage/plugin-search-common.md) — 308.5K weekly downloads
- [@chain-registry/types](https://npm.io/package/@chain-registry/types.md) — 38.4K weekly downloads

## Recent versions

- 13.0.5 (latest) — 2026-08-27
- 7.0.0-beta.68 (canary) — 2023-07-02
- 3.3.1-next.19 (next) — 2021-09-15
- 13.0.4 — 2026-07-22
- 13.0.3 — 2026-07-21
- 13.0.2 — 2026-05-15
- 13.0.0 — 2026-05-04
- 12.3.1 — 2026-04-26
- 12.3.0 — 2026-04-26
- 12.2.0 — 2026-04-21
- 12.1.0 — 2026-04-20
- 12.0.1 — 2026-04-19
- 12.0.0 — 2026-04-19
- 11.7.1 — 2026-04-13
- 11.6.0 — 2026-04-06
- … 87 more at https://npm.io/package/@secretlint/secretlint-rule-no-dotenv/versions

## README

# @secretlint/secretlint-rule-no-dotenv
A secretlint rule for dotenv.

Prevents commits  `.env` file because it may contain credentials.

## Install

Install with [npm](https://www.npmjs.com/):

    npm install @secretlint/secretlint-rule-no-dotenv

## Usage

Via `.secretlintrc.json`(Recommended)

```json
{
    "rules": [
        {
            "id": "@secretlint/secretlint-rule-no-dotenv",
            "options": {
                "allowFileNames": [".env.local", ".env.test"]
            }
        }
    ]
}
```

The `allowFileNames` option allows you to specify certain .env files that should be allowed. This is useful for environment-specific configuration files that are safe to commit. Note that this option works alongside `.secretlintignore`, giving you flexibility in how you want to manage your environment files.

## MessageIDs

### FOUND_DOTENV_FILE
> found .env file

Disallow to commit `.env` file, because dotenv document describe that

> Should I commit my .env file?
> 
> No. We strongly recommend against committing your .env file to version control.
> 
> -- <https://github.com/motdotla/dotenv#should-i-commit-my-env-file>

You can tell Secretlint to ignore `.env` file by [`.secretlintignore`](https://github.com/secretlint/secretlint/blob/master/docs/configuration.md#secretlintignore) configuration.

For more details `.secretlintignore`, see following document.

- <https://github.com/secretlint/secretlint/blob/master/docs/configuration.md#secretlintignore>

## Author

- [Munieru](https://github.com/munierujp)

## License

MIT © secretlint

---
_Source: https://npm.io/package/@secretlint/secretlint-rule-no-dotenv · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._