Validation & Review | Ghostable Desktop | Ghostable Menu Validation & Review Validation and Review differ ---------------------------- **Validation** checks environment values against an explicit schema. **Review** inspects repository hygiene, including hard-coded secrets and environment drift. Run both: a value can satisfy its schema while the same credential is accidentally embedded in source code. Validation rules ---------------- The Validation page lists project rules from `.ghostable/schema.yaml` and shows diagnostics for the current environment. Add rules for keys whose absence or shape should block a release. Supported rules are defined by the bundled CLI and include common contracts such as: `required` Require the key to exist and contain an acceptable value. `format / pattern` Require a value to match an expected shape. `allowed values` Restrict a key to an approved set. `different_from` Require the value to differ from another environment. `unique` Require an environment-specific value where reuse would be unsafe. Use the [CLI Validation reference](https://ghostable.dev/docs/3.x/reference/validation) for the current rule grammar and edge cases. Desktop edits the same schema. ![Ghostable Desktop project validation rules and diagnostics](https://ghostable.dev/images/generated/screenshots/ghostable-desktop-v3/project-validation-light.png)![Ghostable Desktop project validation rules and diagnostics](https://ghostable.dev/images/generated/screenshots/ghostable-desktop-v3/project-validation-dark.png)Global rules and environment overrides make missing or invalid configuration explicit. Environment overrides --------------------- Global rules apply across environments. Environment overrides narrow or adjust a rule for one target, such as enforcing a production-only hostname or allowing a development placeholder. Prefer a clear global contract plus small overrides. Duplicating the entire schema per environment makes drift harder to review. Review scanning --------------- The Review page runs repository checks through the CLI. Hard-coded secret findings identify likely credentials in tracked or working-tree source. Environment checks surface keys that are missing, unexpectedly reused, or inconsistent with project expectations. Review findings are evidence, not automatic rotation. If a real credential reached source or Git history, remove it from code, rotate it at the provider, update Ghostable, and assess the history separately. ![Ghostable Desktop project Review results for environment and secret findings](https://ghostable.dev/images/generated/screenshots/ghostable-desktop-v3/project-review-light.png)![Ghostable Desktop project Review results for environment and secret findings](https://ghostable.dev/images/generated/screenshots/ghostable-desktop-v3/project-review-dark.png)Review combines ENV diagnostics, hard-coded secret scanning, and hygiene findings. Scan levels and ignored paths ----------------------------- `relaxed` Lower-noise checks for repositories with many fixtures or generated patterns. `standard` The default balance for normal application repositories. `strict` Broader detection when false positives are acceptable during a security-focused review. Ignored paths are project policy. Keep the list narrow and review every addition. Generated directories and encrypted Ghostable value paths are reasonable defaults; application source should not be excluded merely to make a finding disappear. Before committing ----------------- 1. Resolve blocking validation errors for each changed environment. 2. Run Review at the project's configured scan level. 3. Investigate new findings and document intentional exceptions through project policy. 4. Inspect the Git diff for schema, scan settings, ignored paths, and encrypted state. 5. Commit the smallest coherent change. On this page [ ![Ghostable](https://ghostable.dev/images/logo-dark.svg) ![Ghostable](https://ghostable.dev/images/logo-light.svg) ](https://ghostable.dev) Desktop [ CLI 3.x ](https://ghostable.dev/docs/3.x) [ Desktop ](https://ghostable.dev/docs/desktop) CLI 3.x introduction Documentation local first no login encrypted repository plaintext hosted service Installation Documentation brew homebrew npm npx linux windows PATH version update Start a new project Getting Started setup seed dotenv owner initialize Adopt an existing project Getting Started existing env import authoritative source adopt Onboard a team member Getting Started join request approve roles offboarding pull request Repository and storage Core Concepts .ghostable git conflict merge worktree private identity metadata Environments Core Concepts protected production preview staging push sync pull replace run mask-output Variables and promotions Core Concepts var promote copy context annotation key Access and devices Core Concepts identity reader writer grantor owner revoke rotate leave delete Daily development workflow Workflows pull diff validate review clean daily Review and secret scanning Workflows scan sarif github suppress secrets drift Hygiene and rotation Workflows rotation stale unused suppression environment key Automation credentials Automation & CI GHOSTABLE\_CI\_TOKEN ci deploy credential powershell revoke replace Continuous integration Automation & CI GitHub Actions fork pull request JSON stdout stderr exit codes mask-output Deployments Automation & CI Forge Vapor Cloud provider CLI dry-run preserve remote keys temporary files Validation Reference schema required nullable regex min max different\_from Command reference Reference --help --json NO\_COLOR flags aliases exit code automation Configuration Reference ghostable.yaml activity mode auditEnvironments scan ignores deployTarget dotenv syntax Security Reference cryptography XChaCha20 Poly1305 HKDF user presence threat model Backups & Offline Reference recovery offline restore clone key identity Agent integration Reference AGENTS.md capabilities allowlist coding agent Troubleshooting Reference no project found revoked identity stale policy user presence invalid CI token provider CLI git conflict diagnostics Ghostable Desktop overview Desktop Installation Desktop Projects and setup Desktop Interface tour Desktop Environments and variables Desktop Local environment files Desktop Validation and review Desktop Activity Desktop Access and automation Desktop Project settings Desktop Application settings Desktop Licensing and updates Desktop Security and storage Desktop Troubleshooting Desktop No results found