DEV Community

ke jia
ke jia

Posted on

The .env File in Your Public Repo Is Already Leaked: Check in 1 Command

#javascript #node #security #devops

There is a five-minute window between the moment you push a .env file to a public repo and the moment a bot grabs it.

Not a human. A bot. There are scrapers that watch git push events and GitHub API polling specifically for this pattern. Your database URL, your API keys, your JWT secret — collected, stored, and used within the hour.

The good news: checking whether this has happened to you takes one command.

The Scan

DotGuard is a zero-dependency scanner that walks a directory, finds every .env file, and checks each line against known dangerous patterns:

  • Hardcoded passwords
  • API keys and access tokens
  • Long secret-looking strings
  • Private key blocks (RSA, OpenSSH, etc.)
  • Database connection URLs

Run it on your project:

npx @wuchunjie/dotguard .
Enter fullscreen mode Exit fullscreen mode 
  🔍  Scanning: /home/dev/my-app

  📄  .env (2 issues)
    ⚠️  L  3 | API key
       API_KEY=sk-abc123def456...
    ⚠️  L  7 | Database URL
       DATABASE_URL=postgres://admin:pass@db.internal:5432/app
Enter fullscreen mode Exit fullscreen mode

Clean project? You get a green light:

  ✅  No issues found!
Enter fullscreen mode Exit fullscreen mode

Note the exit code: it is 1 when it finds potential secrets. That single detail is what makes it useful in automation (more below).

What It Checks, Exactly

Pattern Example it catches
Hardcoded password PASSWORD=hunter2
API key API_KEY=sk-...
Access token TOKEN=ghp_...
Private key BEGIN OPENSSH PRIVATE KEY
Database URL DATABASE_URL=postgres://user:pw@host/db
Long secret string any quoted 20+ char blob

It also flags .env files missing basics like NODE_ENV — the small gap that causes "works on my machine" deploys.

The 60-Second Audit

If you have not checked your repos in a while:

# 1. Scan every project
npx @wuchunjie/dotguard ~/code/my-app
npx @wuchunjie/dotguard ~/code/side-project

# 2. If something shows up:
#    - Rotate that secret NOW (in the provider's dashboard)
#    - Add .env to .gitignore
#    - Commit a .env.example with empty values
Enter fullscreen mode Exit fullscreen mode

Rotation is the part everyone skips. Scanning without rotating is like finding a hole in the boat and taking a photo of it.

npm: @wuchunjie/dotguard | GitHub: wuchunjie00/devtools

From the same toolbox

  • ScaffoldX — generate production-ready project templates in seconds: npx scaffoldx-cli
  • DotGuard — scan .env files for exposed secrets: npx @wuchunjie/dotguard
  • GitPulse — git analytics (commits, contributors, activity) in your terminal: npx @wuchunjie/gitpulse
  • SnippetX — save, search, and copy code snippets from the terminal: npx @wuchunjie/snippetx

GitHub: wuchunjie00/devtools

☕ If This Saved You Time

All of these tools are and will always be 100% free. If they make your day a little easier, consider fueling the next one:

Buy me a coffee on Ko-fi

Built with ❤️. Zero dependencies, zero tracking, zero bloat.

Top comments (0)