Environment configuration files

Identifies environment and application configuration files (.env, appsettings.json, application.properties/yml, web.config) with populated configuration: environment variable assignments, connection/host values or config sections. Secret values themselves are handled by the credential classifiers.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: file-name wording is discovery-only; enforcement requires populated assignments, hosts or sections, and 85 adds a second structure and environment context.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?i)(?:(?<![\w.])\.env(?:\.(?:local|production|prod|staging|development|dev|test))?\b|\bappsettings(?:\.[A-Za-z]{2,20})?\.json\b|\bapplication(?:-[a-z]{2,20})?\.(?:properties|ya?ml)\b|\bweb\.config\b|\bdotenv\s+file\b|\benvironment\s+(?:configuration|variables?)\s+(?:file|for\s+(?:production|staging|prod))\b)

Corroborative evidence keywords

production, staging, do not commit, secrets manager, key vault

Proximity: 300 characters

Should match

.env.production for the rates-api service (do not commit) APP_ENV=production DB_HOST=rates-db01.example.internal DB_PORT=5432 DB_USER=rates_app DB_PASSWORD=<redacted> REDIS_URL=redis://cache01.example.internal:6379 SMTP_HOST=relay.example.internal — High tier (85) - env assignments and connection hosts with production/do-not-commit context (secret value redacted)
appsettings.Production.json { "ConnectionStrings": { "RatesDb": "<redacted>" } } — Medium tier (75) - config section only
application.properties for the permits service: spring.datasource.url = <redacted> — Medium tier (75) - spring datasource key only
Remember to add the new flag to the .env file before you restart the container. — Discovery tier (65) - file wording only

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
Secrets management guidance note: organisations should keep .env files out of source control and load credentials from a secrets manager. — Guidance text
.env blank template DB_HOST= DB_PORT= DB_PASSWORD= — Blank template
Tutorial: create a .env file with APP_ENV=development and run the demo app. — Tutorial/demo framing must not enforce

Known false positives

Framework documentation and README files show example .env and appsettings content. Mitigation: File wording is discovery-only; enforcement needs populated non-placeholder assignments, hosts or sections, and guidance/tutorial/demo/template framing is excluded.