.env Security Scanner
Paste your .env file and get an instant security audit. Detects exposed credentials, cloud secrets, database keys, and environment-leak risks.
Your .env content never leaves your browser. We analyse key names only.
Paste a .env file to scan for security issues
How It Works
Paste Your .env
Paste any .env file — local, staging, or production. Your values never leave the browser.
Key-Name Analysis
We scan key names for credential patterns, cloud secrets, database URLs, environment leaks, and duplicates — all client-side.
Security Report
Get a security grade from A to F, severity-ranked issues, and per-key recommendations you can copy as Markdown.
FAQ
Is my .env file sent to a server?
No. Everything is parsed and analysed in your browser using JavaScript. Your file contents — including values — never leave your device. We only inspect key names.
What exactly does the scanner check?
We check key names for patterns that indicate sensitive credentials (passwords, API keys, tokens), cloud provider secrets (AWS, GCP), database connection strings, crypto material (private keys, certificates), environment-leak risks (DEV/STAGING in key names), duplicate keys, malformed key names, and empty values.
How is the security score calculated?
You start at 100 points. Each Critical issue (cloud credentials, private keys) deducts 25 points. High issues (database credentials, API keys) deduct 15. Medium issues (generic secrets) deduct 8. Low issues (environment leaks, empty values) deduct 3. The minimum score is 0.
Does the scanner read my actual secret values?
No. The scanner only analyses key names — the left-hand side of each KEY=VALUE line. Values are parsed to detect empty values and for display, but are never transmitted, stored, or used for pattern matching beyond that.
Secure your stack end to end
Track releases for Kubernetes, Docker, Terraform, and hundreds more — delivered straight to your inbox when new versions land.