.env Secrets Checker 🔐

Scans your .env files and git history for accidentally committed secrets, API keys, and credentials.

Why?

• 39% of GitHub repos have accidentally committed secrets (GitGuardian 2024 report)
• .env files get committed by mistake all the time
• Keys in git history persist even after you delete the file

Quick Start

git clone https://github.com/spinov001-art/env-secrets-checker
cd env-secrets-checker
python checker.py /path/to/your/project

No dependencies needed. Pure Python 3.

What It Checks

Check	Description
.env files	Scans for API keys, tokens, passwords in .env and .env.* files
.gitignore	Verifies .env is in .gitignore
Git history	Searches git log for accidentally committed secrets
Config files	Checks config.json, settings.py, etc. for hardcoded credentials
Docker files	Checks docker-compose.yml and Dockerfile for exposed secrets

Detected Secret Types

• AWS Access Keys (AKIA...)
• GitHub Tokens (ghp_, github_pat_)
• Stripe Keys (sk_live_, pk_live_)
• Slack Tokens (xoxb-, xoxp-)
• Google API Keys
• JWT Tokens
• Generic passwords, API keys, secrets
• Database connection strings with credentials

Example Output

=== .env Secrets Checker ===
Scanning: /path/to/project

📁 .env files:
  ✅ .env is in .gitignore
  ⚠️  .env.production found — contains 3 secrets
      - AWS_SECRET_ACCESS_KEY (line 4)
      - STRIPE_SECRET_KEY (line 12)
      - DATABASE_URL with password (line 18)

📜 Git history:
  🔴 .env was committed in abc1234 (2024-01-15)
  🔴 config.json contained API_KEY in def5678 (2024-02-03)

📄 Config files:
  ⚠️  docker-compose.yml has POSTGRES_PASSWORD in plaintext (line 22)

Summary: 5 issues found (2 critical, 3 warnings)

CI/CD Integration

# .github/workflows/secrets-check.yml
- name: Check for secrets
  run: python checker.py . --fail-on-critical

Pre-commit Hook

# .git/hooks/pre-commit
python /path/to/checker.py . --staged-only --fail-on-critical

Related

• API Vulnerability Scanner — OWASP API security checks
• npm Typosquat Scanner — npm supply chain security
• Awesome Free APIs — 300+ free APIs

License

MIT

• GitHub Security Scanner — Scan repos for dependency vulnerabilities
• Git Secrets Audit — Scan git history for leaked credentials