Scrub Env Protection

Validate that .gitignore properly protects sensitive files from being committed.

Usage

Execute the env protection script:

bash "$CLAUDE_PLUGIN_ROOT/scripts/scrub-env.sh" [--fix] [directory]

Options

• --fix or -f: Add missing security patterns to .gitignore
• directory: Path to check (defaults to current directory)

Checks Performed

1. Required Security Patterns

Ensures these are in .gitignore:

• .env, .env.*, .env.local
• *.pem, *.key, *.p12, *.pfx
• *.keystore, *.jks
• id_rsa, id_ed25519
• credentials.json, secrets.json
• *.log

2. Recommended Patterns

Warns if missing (not auto-added):

• node_modules/, __pycache__/
• .DS_Store, Thumbs.db
• *.swp, *.swo
• .idea/, .vscode/
• *.sqlite, *.db

3. Tracked Sensitive Files

Alerts if sensitive files are already tracked by git and provides commands to untrack them.

Examples

• /scrub:env - Check .gitignore coverage
• /scrub:env --fix - Add missing security patterns
• /scrub:env ./my-project - Check specific project

Fixing Tracked Files

If sensitive files are already tracked:

git rm --cached .env
git rm --cached credentials.json
git commit -m "Remove tracked sensitive files"