Unused Variable Detector

Dead configuration is configuration debt. Every API_KEY left in .env after its feature was removed is a clue for attackers AND a maintenance trap: a future refactor can accidentally re-enable a feature by reusing the same name.

The Unused Variable Detector cross-references your .env against a paste of your source (or any folder listing, config dump, or template). Each key gets a usage count, and keys that appear nowhere are listed as candidates for removal.

It understands the common ways code addresses dotenv keys — bare name, camelCase, underscore-stripped and lowercased — so a key read as process.env.API_KEY, apiKey or apikey is counted as used. A comment-ignore toggle cuts out the noise. All matching happens locally.

• Two-pane: .env and source pasted side by side.
• Usage counts: per-key matches across the code.
• Four match modes: as-is, camelCase, stripped, lower.
• Comment ignore: skip // and # lines.
• Used vs unused: two report sections.
• Copy or download: export findings.
• Instant: re-scans on input.
• Private: 100% in-browser.

1. Paste your .env into the first box.
2. Paste your source or codebase listing into the second.
3. Pick match modes and click Scan.
4. Review the unused list and delete dead keys with confidence.

Example 1 — Shipped with older env. A repo still sets LEGACY_STRIPE_KEY years after moving to STRIPE_SECRET_KEY. The detector shows zero matches.

Example 2 — Renamed var. A refactor changed process.env.SMTP_HOST to process.env.SMTP_URL; the old key now reports no usages.

Example 3 — Template leakage. A CI yaml template references ENV_VAR the app never calls; the tool flags it as a security surface.

Example 4 — Grep-proof find. Code reads the key as apiKey from a config loader; the camelCase toggle counts it as used so it is not deleted by mistake.

Example 5 — Post-merger hygiene. After merging feature branches, the team runs the detector and prunes a dozen keys that were never wired up.

• Finds dead keys: shrink the attack surface.
• Reads real usage: four naming forms matched.
• Low noise: comment lines can be ignored.
• No install: works on any file content.
• Private: source never leaves the browser.
• Free: run as often as needed.