Question 1

Why scan .env files?

Accepted Answer

Leaked API keys in .env files are the most common cause of cloud security incidents. A single committed .env file can expose your entire infrastructure. Scanning before commit catches mistakes early.

Question 2

Is my data sent anywhere?

Accepted Answer

No. All processing happens in your browser. The live network counter on the page tracks outbound requests — it should always stay at 0. No fetch/XHR calls with your text, no localStorage, no analytics.

Question 3

What secrets are detected?

Accepted Answer

Six categories: Cloud API keys (OpenAI, Anthropic, AWS, GCP, Azure), database connection strings with passwords, auth tokens (GitHub, GitLab, Slack, Stripe), private keys (RSA, EC, OpenSSH), JWT tokens, and generic secrets (variables named password, secret, token, key with non-empty values).

Question 4

How to fix leaked secrets?

Accepted Answer

Immediately rotate the compromised credential. Add .env to .gitignore. Use tools like git-filter-repo to remove the file from history. Enable secret scanning on GitHub.

Question 5

Can I use it offline?

Accepted Answer

Yes. Once loaded, the page works fully offline — open DevTools Network tab, set Offline, paste your .env, and scanning still works.

.env Security Scanner (2026)