.env Secret Scanner

Secrets do not announce themselves. STRIPE_KEY=sk_live_9f2a... is obvious; SETTING_12=u7g3Kp9Q...QnZ is not. The .env Secret Scanner looks for both signals at once — telling key names and credential-shaped values — and flags them by line with a masked value and a risk level.

It is a triage tool for the moment before you paste a .env into a ticket, a screenshot, or a commit: run the scan, see what it would expose, and rotate anything that looks live. It detects Stripe-style sk_live_ keys, AWS access keys, OAuth-style tokens, generic high-entropy strings, and credentials embedded in URLs.

The scan never uploads anything, and it shows only masked values so the result itself is safe to share.

• Key-name rules: KEY, SECRET, TOKEN, PASSWORD, PASSWD.
• Value patterns: sk_live_, AKIA, Bearer, base64-like.
• URL credentials: scheme://user:pass@host caught.
• Risk levels: high / medium / low per item.
• Masked values: output never leaks full secrets.
• Line numbers: exact locations in the file.
• Summary: counts by risk tier.
• Private & free: all in-browser.

1. Paste your .env into the input, or load the sample with realistic-looking secrets.
2. Click Scan. Every suspected secret is listed with a risk level.
3. Review masked values and rotate anything that looks live.
4. Export the report or clear it when done.

Example 1 — Live key leak. A developer pastes a .env into a GitHub issue to ask for help. The scan surfaces sk_live_... with high risk, and the key gets rotated that day.

Example 2 — Anonymized screenshot. A config panel screenshot is going into docs; the scanner shows the screenshot would reveal a bearer token.

Example 3 — Neutral name. OPTIONS_X=eJw...A3 holds a long token under an innocent name; the value pattern catches it.

Example 4 — Embedded URL credentials. DATABASE_URL=postgres://admin:hunter2@db/prod is flagged so the password stops living in plain text.

Example 5 — Pre-commit ritual. The scan becomes the 30-second habit before any commit that could touch .env.

• Two-way detection: name and value signals.
• Risk triage: prioritize what to rotate.
• Share-safe output: only masked values shown.
• Fast: instant in-browser scan.
• Private: nothing is uploaded.
• Free: use whenever you need it.