Skip to content
SlashClone
DiscoverUse in ClaudeSubmit a link
Sign in
Made by@shipcheck

Env secrets check

@shipcheck/env-secrets-check

Check your repo for leaked secrets before you push or launch: .env files git tracks or will pick up, .env files hiding in git history, server keys behind NEXT_PUBLIC_ or VITE_ prefixes that ship to the browser, provider key shapes (Stripe, AWS, GitHub, OpenAI, Anthropic, Supabase service_role), and passwords hardcoded in code. Reports names and redacted hints, never the values.

SkillDevOpsv1.0.0 (latest)Tested
Use in Claude Save Like Clone Comment
Activity
New: be the first to try it
  1. 1---
  2. 2name: env-secrets-check
  3. 3description: Scan a project for leaked secrets before pushing, open-sourcing, or launching. Finds .env files that git tracks or will commit, .env files left in git history, server keys exposed to the browser through NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_ or REACT_APP_ prefixes, provider key shapes (Stripe, AWS, GitHub, OpenAI, Anthropic, Slack, Supabase service_role, database URLs with passwords), and hardcoded passwords. Use when the user says "did I leak any keys", "is my .env safe", "check for secrets", "can I make this repo public", before a first deploy, or after a key-leak warning email.
  4. 4license: MIT
  5. 5---
  6. 6
  7. 7# Env and secrets check
  8. 8
  9. 9Vibe-coded apps leak keys in a few predictable ways: a `.env` that was never ignored, a service key with a `NEXT_PUBLIC_` prefix so it ships to every browser, or a key pasted straight into code. This skill finds those, ranks them, and walks the user through fixing and rotating. It reports names and short redacted hints only, never full values.
  10. 10
  11. 11## When to use
  12. 12
  13. 13- Before the first `git push`, before making a repo public, before launch.
  14. 14- After GitHub, a provider, or a stranger emails about a leaked key.
  15. 15- "Is my .env safe?", "did I commit my Stripe key?", "should this be NEXT_PUBLIC?"
  16. 16
  17. 17## Steps
  18. 18
  19. 191. **Run the scan** from the project root.
  20. 20
  21. 21 ```bash
  22. 22 node scripts/secrets-scan.mjs . --json out/secrets-report.json --md out/secrets-report.md
  23. 23 ```
  24. 24
  25. 25 With git it scans tracked files plus new files git would add, and checks history for `.env` files. Without git it follows `.gitignore`.
  26. 26
  27. 272. **Show the summary** (High, Medium, Low counts) and every high finding in plain words: what leaked, where, and who can see it.
  28. 283. **Sort the high findings into two piles:**
  29. 29 - **Already exposed:** the file is committed, in history, pushed, or deployed with a public prefix. These keys must be rotated. Moving them is not enough.
  30. 30 - **About to be exposed:** not committed yet. Fixing the file is enough.
  31. 31
  32. 32 Ask whether the repo has been pushed and whether it is public if you cannot tell. `git log` is fine for checking history.
  33. 334. **Fix, with a yes for each change:**
  34. 34 - Add missing lines to `.gitignore` (`.env*`, `!.env.example`). Show the lines first.
  35. 35 - For a committed env file, give the user the command `git rm --cached <file>` to run. It keeps their local copy.
  36. 36 - For public-prefix secrets, rename the variable (drop the prefix), and move every use into server code (API routes, server actions, edge functions). Show the diff.
  37. 37 - For hardcoded values, replace them with `process.env.NAME` and add `NAME=` to `.env.example`.
  38. 385. **Rotation checklist.** For each exposed key, write a numbered list in `out/rotate-keys.md`: the provider, where in its dashboard to roll the key, and where to paste the new one (local `.env.local`, then the host's env settings, then redeploy).
  39. 396. **Re-run step 1** and show that high is 0.
  40. 40
  41. 41## Output format
  42. 42
  43. 43```markdown
  44. 44# Secrets check: <project>
  45. 45High 2 | Medium 3 | Low 1
  46. 46
  47. 47## Rotate now (already exposed)
  48. 481. STRIPE_SECRET_KEY: committed in .env (git tracks it). Roll it in Stripe, Developers, API keys.
  49. 49
  50. 50## Fix before you push
  51. 51- .env.local is not in .gitignore. Added .env* (you said yes).
  52. 52
  53. 53## Check
  54. 54- NEXT_PUBLIC_MAPBOX_TOKEN ships to the browser. Fine if it is restricted by URL.
  55. 55```
  56. 56
  57. 57## What is public on purpose
  58. 58
  59. 59These are meant for the browser and are not findings: Supabase URL and anon (publishable) key, Stripe publishable key (`pk_`), Firebase web config, analytics IDs, Sentry DSN, Mapbox tokens restricted by URL. The anon key is only safe when RLS is on; suggest the supabase-rls-audit kit if the project uses Supabase.
  60. 60
  61. 61## Guardrails
  62. 62
  63. 63- Never open, print, or paste the contents of `.env` files, and never repeat a full secret value. The script output is redacted; keep it that way.
  64. 64- Never rewrite git history (`filter-repo`, force push) yourself. If the user wants history cleaned, explain the trade-offs and let them run it. Rotation matters more than history.
  65. 65- Never call a provider API to test whether a key works.
  66. 66- Never move a secret into a public prefix to "make it work" in the browser. The fix is a server route.
  67. 67- A clean scan is not a guarantee. Say so, and mention keys in screenshots, logs, and chat messages too.
Sign in to comment on a line