Git History Env Leak Scanner

The scariest .env leak is the one in history: the commit is long gone from the working tree, but the secret survives in a past revision forever — visible in git log -p to anyone who cloned the repo. The Git History Env Leak Scanner makes those commits findable.

You paste the output of git log --all --name-status, and the scanner flags every revision that added, modified, renamed, or deleted an env file. Each key with a secret-hinting name is surfaced with the commit hash, date, subject, and file path, and a risk level helps you prioritize rotation.

This is pattern-based review of the log text, deliberately not AI. Everything stays in your browser.

• Commit flagging: every env-file change in the log.
• Secret-key hints: KEY, SECRET, TOKEN, PASSWORD names.
• Risk levels: prioritize which commits to audit.
• Commit metadata: hash, date, author, subject kept.
• File paths: exactly which file was touched.
• Summary: count of risky commits.
• Copy or download: export the audit.
• Private: pattern scan, all in browser.

1. Run git log --all --name-status --pretty=format:'%h|%ad|%s' --date=short in your repo.
2. Paste the output into the input, or load the sample.
3. Click Scan. Env-file commits are listed with risk.
4. Prioritize rotation and clean up history with git filter-repo.

Example 1 — The deleted .env. A developer deleted .env in commit f3c92a1, but the log shows it was added months earlier — the secret is still in history.

Example 2 — Renamed on purpose. An env file was renamed from .env to config/app.env; the rename commit is flagged so the old path never slips into a checkout.

Example 3 — Secret-hinting key. A commit adds SMTP_PASSWORD=true into docker-compose overrides; the scanner flags the key name even though the file is not named .env.

Example 4 — Before a public release. A repo is about to go open-source; the scan finds three env commits the team thought were cleaned years ago.

Example 5 — Rotation planning. After a breach, the scan produces the exact list of commits whose secrets must be rotated.

• Finds history leaks: the ones that survive deletion.
• Prioritized: risk levels guide the audit.
• Git-native: reads real log output.
• Pattern-based: fast, deterministic, no AI.
• Private: nothing leaves the browser.
• Free: run on any repo.