.env Security Scanner
Processing: API. Processed by cent-ai's API: sent to our server, held in memory, never stored.Paste .env-style configuration to scan for exposed secrets and risky configuration patterns. Nothing you paste here is stored or logged.
How to use it
- Paste the contents of a
.envfile. - Select “Run check” to scan for secrets and configuration risks.
- Review findings, most severe first.
Example
Select “Use example” above to load sample content with a fake AWS key, a publicly-exposed secret-looking variable, and a debug flag left on in production.
Privacy and security
- Content is sent to our API only to run the scan; it is never persisted or logged.
- No LLM is used — detection is deterministic pattern/context/entropy matching plus fixed configuration rules.
- Findings never include the full matched value.
Limitations
- Best-effort
KEY=VALUEparsing — not a full dotenv implementation (no multi-line values). - A finding is never a confirmation that a value is a real, currently-valid secret — always verify before rotating.
- Input is capped at 256 KB.
FAQ
What does it check beyond secret detection?
It uses the same secret-detection engine as the Secret Scanner, plus .env-specific checks: variables prefixed for public/client exposure (NEXT_PUBLIC_, VITE_, etc.) that look like they hold a credential, obvious weak/default values on credential-shaped keys, insecure http:// URLs, and debug flags left on alongside a production environment.
Why is a publicly-exposed variable treated as more severe than a regular one?
A NEXT_PUBLIC_/VITE_/REACT_APP_-prefixed variable ships to every visitor's browser, not just your server. If it looks like a real credential, that's a more urgent problem than the same value sitting in a server-only .env file.
Does it process this on the server?
Yes — unlike the Secret Scanner, this tool's input is sent to our API to run the combined checks; it is never persisted or logged.