Secret Exposure Scanner

Secrets injected as environment variables are easy to leak, while Secrets mounted as volumes are the recommended pattern. The Secret Exposure Scanner parses a pasted Pod or workload and reports every Secret reference, classifying env-based usage as high exposure and volume mounts as recommended.

It detects env.valueFrom.secretKeyRef, envFrom.secretRef and volume mounts of Secret-type volumes. The pod template is extracted automatically from Deployments/StatefulSets/DaemonSets.

Parsing uses a small tolerant YAML reader (no external dependency). Nothing is uploaded. Everything runs locally.

• Env detection - secretKeyRef and envFrom.secretRef flagged as exposure.
• Volume detection - Secret volumes mounted (recommended).
• Severity - high for env, low for volume mounts.
• Workload aware - extracts pod spec from common workloads.
• Copy / Download / Print - take the report anywhere.

1. Paste a Pod or workload YAML.
2. Run the scan and review findings.
3. Copy or download the report.

Example 1 - env exposure. DB_PASSWORD via secretKeyRef -> high.

Example 2 - volume mount. tls Secret mounted -> recommended.

• Visibility - see every Secret reference.
• Guidance - env flagged, volumes praised.
• Private - all in the browser.
• Fast - instant client-side scan.
• Copy, download or print - take it anywhere.