diff --git a/.env.sample b/.env.sample
new file mode 100644
index 0000000..0c297ca
--- /dev/null
+++ b/.env.sample
@@ -0,0 +1,8 @@
+GOOGLE_APPLICATION_CREDENTIALS=/secret/credentials.json
+
+# You can leave the following fields empty if you don't want to publish tweets
+# when a vulnerability is published:
+TWITTER_OAUTH_TOKEN=
+TWITTER_OAUTH_TOKEN_SECRET=
+GOTWI_API_KEY=
+GOTWI_API_KEY_SECRET=