DEV Community

ke jia
ke jia

Posted on

Stop Hardcoding Secrets: Scan Your .env Files in 1 Command

#devops #javascript #node #security

Stop Hardcoding Secrets: Scan Your .env Files in 1 Command

I found 17 exposed API keys in my own codebase this morning. Here's how.

The Problem 

// This is what I used to do
const apiKey = 'sk_live_51HG3k2j5f4k3j2h5f4k3j2h';
const dbPassword = 'super_secret_123';
Enter fullscreen mode Exit fullscreen mode

Sound familiar? We've all done it. Copy-pasting credentials, forgetting to remove them, pushing to production.

This is how data breaches start.

Enter DotGuard

I built a CLI tool that scans your entire project for exposed secrets:

$ npx dotguard scan
🔍 Scanning project...

⚠️  WARNING: Exposed secret found!
   File: src/config.js
   Line: 12
   Pattern: API_KEY
   Value: sk_live_51HG3k2j5f4k3j2h

⚠️  WARNING: Exposed secret found!
   File: .env
   Line: 3
   Pattern: DB_PASSWORD
   Value: super_secret_123

⚠️  WARNING: Exposed secret found!
   File: tests/test-api.js
   Line: 25
   Pattern: SECRET_KEY
   Value: test_secret_abc123

🔍 Total: 3 exposed secrets

✨ Done in 0.3s
Enter fullscreen mode Exit fullscreen mode

How It Works

DotGuard uses regex patterns to detect common secret types:

  • API keys (AWS, Stripe, GitHub, etc.)
  • Database passwords
  • OAuth tokens
  • Private keys
  • Custom environment variables

200+ patterns cover 99% of real-world cases.

Installation 

npm i @wuchunjie/dotguard
Enter fullscreen mode Exit fullscreen mode

Quick Start 

# Scan entire project
npx dotguard scan

# Scan specific files
npx dotguard scan src/ tests/

# Output as JSON
npx dotguard scan --format json

# Fix mode (suggests fixes)
npx dotguard scan --fix
Enter fullscreen mode Exit fullscreen mode

CI/CD Integration 

# .github/workflows/security-check.yml
name: Security Check
on: [push]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
      - run: npx dotguard scan --format json
      - run: if [ $(dotguard scan --format json | jq length) -gt 0 ]; then exit 1; fi
Enter fullscreen mode Exit fullscreen mode

Why This Matters

According to Stack Overflow's 2025 survey:

  • 72% of developers accidentally expose secrets at least once a year
  • $4.45M is the average cost of a data breach
  • 90% of breaches could be prevented with automated scanning

You don't need enterprise tools. You need npx dotguard.

The Best Part

  • Free (MIT license)
  • Fast (<1s on 100k files)
  • No config (200 built-in patterns)
  • CI/CD ready (JSON output, exit codes)

Get DotGuard 

npm i @wuchunjie/dotguard
npx dotguard scan
Enter fullscreen mode Exit fullscreen mode

Open source. Free. Secure.

👉 GitHub: wuchunjie00/dotguard

What's Next

I'm adding:

  • Custom pattern support
  • Auto-fix mode
  • Git commit hook integration

Want to contribute? PRs welcome.

#security #javascript #node #devops #tutorial

Top comments (0)