Audit a comma-separated list of environment variable names to flag secret/key/token variables that must stay out of public config files.