Env secrets check

Name: Env secrets check
Author: @shipcheck

@shipcheck/env-secrets-check

Check your repo for leaked secrets before you push or launch: .env files git tracks or will pick up, .env files hiding in git history, server keys behind NEXT_PUBLIC_ or VITE_ prefixes that ship to the browser, provider key shapes (Stripe, AWS, GitHub, OpenAI, Anthropic, Supabase service_role), and passwords hardcoded in code. Reports names and redacted hints, never the values.

SkillDevOpsv1.0.0 (latest)Tested

Use in Claude Save Like Clone Comment

Activity: New: be the first to try it
Installs: 0 installs
Likes: 0 likes
Clones: 0 clones

1# Env and secrets check
2
3Finds secrets that are about to leak, or already have, before you push or launch. Then it helps you fix the files and gives you a checklist for rotating any key that was exposed.
4
5**For:** anyone shipping an app built with Next.js, Vite, Expo, or similar, especially if a coding agent wrote the env setup for you.
6
7## Example
8
9Input: a project with a `.env.local` that is not in `.gitignore`, `NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY` in it, and a password typed straight into `lib/config.ts`.
10
11Output (`out/secrets-report.md`):
12
13```markdown
14High: 2 | Medium: 3 | Low: 1
15
16## High
17- .env.local (env-file-not-ignored): This env file is not in .gitignore,
18 so the next `git add .` commits it.
19- .env.local:2 (public-env-secret): NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY is
20 bundled into the browser. Anyone can read it in the page source.
21 - Fix: Rename to SUPABASE_SERVICE_ROLE_KEY, read it only in server code.
22
23## Medium
24- lib/config.ts:2 (hardcoded-secret, let... (12 chars)): adminPassword is
25 set to a hardcoded value in code.
26```
27
28Values are always redacted. Try it on the bundled demo: `node scripts/secrets-scan.mjs examples/demo-app`.
29
30## What it checks
31
32- `.env` files tracked by git, not ignored, or found in git history.
33- Server secrets behind `NEXT_PUBLIC_`, `VITE_`, `EXPO_PUBLIC_`, `REACT_APP_`, `NUXT_PUBLIC_`, `GATSBY_`, `PUBLIC_`.
34- Stripe, AWS, GitHub, OpenAI, Anthropic, Slack and Google key shapes, private keys, database URLs with passwords, Supabase service_role keys.
35- Secret-named variables with hardcoded values, and templates (`.env.example`) holding real-looking values.
36
37## What it can access
38
39- Reads files in your project (skipping `node_modules`, build output, and lockfiles). It reads `.env` files only to check names and whether values are set.
40- Runs its own script, plus `git ls-files` and `git log` to see what is committed.
41- Writes reports to `out/`, and edits `.gitignore` only after you say yes.
42- No network, no env vars.
43
44## Setup
45
46None. Needs Node 22 or later. Git is optional.

Use in Claude

Claude Code

/kit add @shipcheck/env-secrets-check

CLI

slashclone add @shipcheck/env-secrets-check

Codex

slashclone add @shipcheck/env-secrets-check --agent codex

Not enforced. Codex does not enforce the permissions this kit declares.

Cursor

slashclone add @shipcheck/env-secrets-check --agent cursor

Not enforced. Cursor does not enforce the permissions this kit declares.

claude.ai and the desktop app

Download for Claude

Not enforced. claude.ai and the Claude desktop app do not enforce the permissions this kit declares. How to upload it

As a file

Download .kit

One file with everything in it. slashclone add ./file.kit checks it against this page before installing.

Review before installing

Set up SlashClone in Claude

Health

No keep-alive checks yet

Checks run weekly once someone keeps the kit installed.

Run reports are off

Safety

Scan passed
Not reviewed yet
Tests pass (2 of 2)

This kit reads ./**, writes to ./out/**, ./.gitignore and runs node scripts/secrets-scan.mjs, git ls-files, git log. Install it?

Full scan and review

Similar kits

Launch checklist
@shipcheck
A pre-launch check for your first real app. Reads your project, detects the stack (Supabase, Stripe, Next.js, auth, email), and writes a checklist split into blockers, first-week items, and later, with evidence from your code for each item it could verify. Covers data access, payments, secrets, auth, abuse limits, errors and monitoring, backups, email deliverability, legal pages, and SEO basics.
Stripe webhook hardening
@shipcheck
Find your Stripe webhook handlers and harden them: verify the Stripe-Signature header, use the raw body, keep the signing secret in env, process each event once, reject bad signatures with 400, and fulfill orders from the webhook rather than the success page. Reads your code and proposes diffs; never calls Stripe.
Deploy doctor
@shipcheck
Paste a failed Vercel or Netlify build log and get the most likely cause and a fix you can apply. Recognizes about twenty common failures: letter-case import errors, missing packages, missing env vars, prerender errors, window is not defined, lockfile drift, peer dependency conflicts, wrong Node version, out of memory, wrong output or root folder, oversized functions, and more.
Supabase rls audit
@shipcheck
Audit row level security in your Supabase migrations before you launch. Finds tables with RLS off, policies that let anyone write, policies that trust user_metadata, views that skip RLS, and risky SECURITY DEFINER functions, then drafts a fix migration for you to review. Reads .sql files only and never touches your database.

Link

https://slashclone.dev/@shipcheck/env-secrets-check

README badge

[![Install with SlashClone](https://slashclone.dev/badge/shipcheck/env-secrets-check.svg)](https://slashclone.dev/@shipcheck/env-secrets-check)

Embed

<iframe src="https://slashclone.dev/embed/shipcheck/env-secrets-check" width="480" height="200" title="@shipcheck/env-secrets-check" loading="lazy"></iframe>

Share card image

More from @shipcheck

Supabase rls audit
Audit row level security in your Supabase migrations before you launch. Finds tables with RLS off, policies that let anyone write, policies that trust user_metadata, views that skip RLS, and risky SECURITY DEFINER functions, then drafts a fix migration for you to review. Reads .sql files only and never touches your database.
Stripe webhook hardening
Find your Stripe webhook handlers and harden them: verify the Stripe-Signature header, use the raw body, keep the signing secret in env, process each event once, reject bad signatures with 400, and fulfill orders from the webhook rather than the success page. Reads your code and proposes diffs; never calls Stripe.
Launch checklist
A pre-launch check for your first real app. Reads your project, detects the stack (Supabase, Stripe, Next.js, auth, email), and writes a checklist split into blockers, first-week items, and later, with evidence from your code for each item it could verify. Covers data access, payments, secrets, auth, abuse limits, errors and monitoring, backups, email deliverability, legal pages, and SEO basics.
Deploy doctor
Paste a failed Vercel or Netlify build log and get the most likely cause and a fix you can apply. Recognizes about twenty common failures: letter-case import errors, missing packages, missing env vars, prerender errors, window is not defined, lockfile drift, peer dependency conflicts, wrong Node version, out of memory, wrong output or root folder, oversized functions, and more.

See all of @shipcheck's kits

Report this kit