DEV Community

ke jia
ke jia

Posted on

Stop Hardcoding Secrets: Scan Your .env Files in 1 Command

#security #webdev #javascript #devops

In 2025, GitGuardian found 12.8 million hardcoded secrets in public GitHub repos. API keys, private keys, passwords — all sitting in plain text for anyone to find.

Don't be part of that statistic.

The Problem

You create a .env file. You add API_KEY=sk-live-abc123.... You commit. You push. You're screwed.

# .env — DO NOT COMMIT THIS FILE
DATABASE_URL=postgres://user:password@localhost:5432/db
STRIPE_SECRET=sk_live_abc123def456
AWS_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE
Enter fullscreen mode Exit fullscreen mode

Even if you add .env to .gitignore, what about .env.production, .env.local, env.backup?

The 1-Command Fix 

npx @wuchunjie/dotguard /your/project
Enter fullscreen mode Exit fullscreen mode

Output:

  🔍  Scanning: /your/project

  📄  .env (3 issues)
    ⚠ī¸  L2  | Hardcoded password
       DATABASE_URL=postgres://user:password@localhost...
    ⚠ī¸  L3  | API key
       STRIPE_SECRET=sk_live_abc123def456
    ⚠ī¸  L4  | Access token
       AWS_ACCESS_KEY=AKIAIOSFODNN7EXAMPLE

  ─────────────────────────────
  ⚠ī¸   3 potential secrets exposed!
  💡  Add .env to .gitignore & use .env.example instead.
Enter fullscreen mode Exit fullscreen mode

That's it. Zero config. Zero dependencies. Pure Node.js.

What It Scans For

  • API keys — anything matching api_key=..., token=...
  • Private keys — BEGIN RSA PRIVATE KEY, BEGIN OPENSSH PRIVATE KEY
  • Hardcoded passwords — password=something
  • Database URLs — mysql://, postgres://, mongodb:// with credentials
  • Long random strings — likely tokens or secrets

Integrate Into Your Workflow 

# Pre-commit hook
npx @wuchunjie/dotguard . || exit 1

# CI pipeline
npx @wuchunjie/dotguard . && echo "✅ No secrets found"

# Check before every push
alias pushsafe='npx @wuchunjie/dotguard . && git push'
Enter fullscreen mode Exit fullscreen mode

Bonus: What's Missing?

dotguard also checks for commonly recommended but missing env vars:

  ℹī¸  L0  | Missing NODE_ENV
     Consider adding: NODE_ENV=production
  ℹī¸  L0  | Missing PORT
     Consider adding: PORT=3000
Enter fullscreen mode Exit fullscreen mode

Try It Now 

npx @wuchunjie/dotguard .
Enter fullscreen mode Exit fullscreen mode

⭐ Star on GitHub | npm

Found this useful? Buy me a coffee ☕ — building open-source security tools

Top comments (0)