Command Palette
Search for a command to run...
Env Scanner & Security Analyzer
Audit your .env files for leaked secrets, hardcoded passwords, and configuration vulnerabilities entirely client-side.
How It Works
Simple, fast, and 100% secure in 3 steps.
Paste Your Env File
Copy the raw contents of your .env or .env.local file and paste it into the scanner textarea.
Instant Analysis
Our engine immediately parses variables, checking against known leak patterns, weak defaults, and naming standards.
Review & Export
Review the severity-ranked findings, expand for remediation steps, and export the full report as JSON.
Key Features & Capabilities
Designed for accuracy, privacy, and maximum efficiency.
API Key Leak Detection
Instantly identifies exposed Stripe, AWS, GitHub, and OpenAI live keys using pattern matching.
Next.js Public Exposure
Flags dangerous NEXT_PUBLIC_ prefixes applied to sensitive variables that leak secrets to the browser.
Weak Defaults & Placeholders
Catches insecure defaults like 'changeme', empty strings, and overly permissive wildcards.
Zero Data Transmission
All parsing and analysis occurs locally in your browser. Your secrets never touch our servers.
The Critical Importance of Environment Security
Environment variables are the backbone of modern application configuration, securely storing everything from database URIs to third-party API keys. However, misconfigured .env files are a leading cause of catastrophic data breaches. Exposing a single live Stripe key or AWS access token can result in massive financial liabilities and compromised infrastructure within minutes.
This Env Scanner acts as your first line of defense, performing a rigorous static analysis of your configuration files before they ever reach production. By enforcing strict naming conventions (SCREAMING_SNAKE_CASE), identifying unquoted strings that may break parsing, and detecting accidental commits of live credentials, developers can maintain a hardened security posture.
Common Vulnerabilities Detected
- Browser Exposure: Frameworks like Next.js expose any variable prefixed with
NEXT_PUBLIC_to the client-side bundle. Applying this prefix to database passwords or secret tokens effectively publishes them to the world. - Placeholder Persistence: Development environments often rely on placeholders like"xxx"or"changeme". If these are promoted to staging or production without replacement, they create silent failures or security gaps.
- Overly Permissive CORS: Using wildcards (
*) for CORS origins or API access controls violates the principle of least privilege and invites malicious cross-origin requests.
Frequently Asked Questions
Everything you need to know about using this tool.