`.env.example` does not contain placeholder values in production templates
Why it matters
Values like STRIPE_SECRET_KEY=your_stripe_key_here or DATABASE_URL=TODO in .env.example waste every new contributor's onboarding time. They cannot tell which format the real value takes, whether it is a test key, or what character length to expect. The file exists specifically to bootstrap environments, so a placeholder that communicates nothing defeats its purpose and often leads developers to paste real credentials into the wrong slot.
Severity rationale
Low because these are template files, but placeholder tokens still slow onboarding and risk credential misplacement.
Remediation
Replace placeholder tokens with recognizable example values that preserve format and prefix conventions. Use public Stripe test-mode prefixes, a canonical Postgres URL shape, and documented character counts. Fix at .env.example:
STRIPE_SECRET_KEY=sk_test_xxxxxxxxxxxxxxxxxxxxxxxx
DATABASE_URL=postgresql://user:password@localhost:5432/dbname
NEXT_PUBLIC_SITE_URL=http://localhost:3000
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the WIP-in-Production Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-half-finished·automated