Open methodology · Version 1.0
A practical taxonomy for environment configuration drift.
Environment configuration drift is measurable without inspecting or publishing secret values. This taxonomy classifies differences by key presence, syntax, documentation, and value intent so teams can audit configuration structure reproducibly while keeping sensitive values masked.
What does this methodology measure?
| Class | Definition | Required evidence |
|---|---|---|
| Missing | A required key is absent from the target. | Reference schema or reviewed example. |
| Extra | A target key is absent from the reference. | Key names only. |
| Changed | The same key has a different normalized value. | Masked comparison; human classification. |
| Malformed | A line cannot be parsed as supported dotenv syntax. | Line number and redacted syntax. |
| Undocumented | A key used by code is absent from the documented contract. | Static usage search and contract. |
How can the audit be reproduced?
- Select a documented schema or reviewed `.env.example` as the reference.
- Parse key names without logging values.
- Compare key presence in both directions.
- Record malformed and duplicate definitions.
- Classify changed values as intentional, unknown, or incorrect through owner review.
- Publish aggregate counts, tool version, exclusions, and sampling method—never raw secrets.
What does the method not prove?
Key parity does not prove that a credential is valid, a service is reachable, a value has the correct privilege, or a deployment is secure. Changed values are not automatically defects. The method is a structural audit that must be combined with runtime validation and appropriate production secret controls.
How should public research use it?
A future benchmark should define the public repository sample before analysis, publish selection and exclusion rules, pin the parser version, remove files containing suspected live secrets, and release only aggregate results. This page intentionally reports no benchmark numbers until such a dataset has been collected and reviewed.