EnvGuard Secret & Credential Scanner
Scan repos and workspaces for leaked secrets. API keys in code, passwords in configs, tokens in logs. Catches them before they hit git.
Find leaked secrets before they reach production.
Quick Scan
node src/env-guard.js scan ./my-project
What It Finds
| Secret Type |
Pattern |
| API Keys |
sk-..., AKIA..., ghp_... |
| Passwords |
password=, passwd: |
| Tokens |
token=, bearer ... |
| Private Keys |
-----BEGIN RSA PRIVATE KEY----- |
| Connection Strings |
mongodb://, postgres:// |
| Webhook URLs |
Discord webhooks, Slack webhooks |
Features
- Custom patterns — add your own secret patterns
- Allowlisting — mark false positives to skip
- CI integration — exit code 1 for pipeline gates
Output
🔴 SECRETS FOUND — 3 issues
src/config.js:12
API key detected: sk-proj-...Tm4x (OpenAI)
.env.backup:3
Database password in committed file
logs/debug.log:445
Bearer token logged in plaintext
⚠️ Disclaimer
This software is provided "AS IS", without warranty of any kind, express or implied.
USE AT YOUR OWN RISK.
- The author(s) are NOT liable for any damages, losses, or consequences arising from
the use or misuse of this software — including but not limited to financial loss,
data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
their use case, environment, and risk tolerance.
- No guarantee is made regarding accuracy, reliability, completeness, or fitness
for any particular purpose.
- The author(s) are not responsible for how third parties use, modify, or distribute
this software after purchase.
By downloading, installing, or using this software, you acknowledge that you have read
this disclaimer and agree to use the software entirely at your own risk.
DATA DISCLAIMER: This software processes and stores data locally on your system.
The author(s) are not responsible for data loss, corruption, or unauthorized access
resulting from software bugs, system failures, or user error. Always maintain
independent backups of important data. This software does not transmit data externally
unless explicitly configured by the user.
Support & Links
Built with OpenClaw — thank you for making this possible.
🛠️ Need something custom? Custom OpenClaw agents & skills starting at $500. If you can describe it, I can build it. → Hire me on Fiverr
1---2name: envguard-secret-credential-scanner3description: Scan repos and workspaces for leaked secrets. API keys in code, passwords in configs, tokens in logs. Catches them before they hit git.4license: MIT5---67# EnvGuard Secret & Credential Scanner89Scan repos and workspaces for leaked secrets. API keys in code, passwords in configs, tokens in logs. Catches them before they hit git.1011---1213Find leaked secrets before they reach production.1415## Quick Scan1617```bash18node src/env-guard.js scan ./my-project19```2021## What It Finds2223| Secret Type | Pattern |24|-------------|---------|25| API Keys | `sk-...`, `AKIA...`, `ghp_...` |26| Passwords | `password=`, `passwd:` |27| Tokens | `token=`, `bearer ...` |28| Private Keys | `-----BEGIN RSA PRIVATE KEY-----` |29| Connection Strings | `mongodb://`, `postgres://` |30| Webhook URLs | Discord webhooks, Slack webhooks |3132## Features3334- **Custom patterns** — add your own secret patterns35- **Allowlisting** — mark false positives to skip36- **CI integration** — exit code 1 for pipeline gates3738## Output3940```41🔴 SECRETS FOUND — 3 issues4243src/config.js:1244 API key detected: sk-proj-...Tm4x (OpenAI)4546.env.backup:347 Database password in committed file4849logs/debug.log:44550 Bearer token logged in plaintext51```52---5354## ⚠️ Disclaimer5556This software is provided "AS IS", without warranty of any kind, express or implied.5758**USE AT YOUR OWN RISK.**5960- The author(s) are NOT liable for any damages, losses, or consequences arising from 61 the use or misuse of this software — including but not limited to financial loss, 62 data loss, security breaches, business interruption, or any indirect/consequential damages.63- This software does NOT constitute financial, legal, trading, or professional advice.64- Users are solely responsible for evaluating whether this software is suitable for 65 their use case, environment, and risk tolerance.66- No guarantee is made regarding accuracy, reliability, completeness, or fitness 67 for any particular purpose.68- The author(s) are not responsible for how third parties use, modify, or distribute 69 this software after purchase.7071By downloading, installing, or using this software, you acknowledge that you have read 72this disclaimer and agree to use the software entirely at your own risk.737475**DATA DISCLAIMER:** This software processes and stores data locally on your system. 76The author(s) are not responsible for data loss, corruption, or unauthorized access 77resulting from software bugs, system failures, or user error. Always maintain 78independent backups of important data. This software does not transmit data externally 79unless explicitly configured by the user.8081---8283## Support & Links8485| | |86|---|---|87| 🐛 **Bug Reports** | TheShadowyRose@proton.me |88| ☕ **Ko-fi** | [ko-fi.com/theshadowrose](https://ko-fi.com/theshadowrose) |89| 🛒 **Gumroad** | [shadowyrose.gumroad.com](https://shadowyrose.gumroad.com) |90| 🐦 **Twitter** | [@TheShadowyRose](https://twitter.com/TheShadowyRose) |91| 🐙 **GitHub** | [github.com/TheShadowRose](https://github.com/TheShadowRose) |92| 🧠 **PromptBase** | [promptbase.com/profile/shadowrose](https://promptbase.com/profile/shadowrose) |9394*Built with [OpenClaw](https://github.com/openclaw/openclaw) — thank you for making this possible.*9596---9798🛠️ **Need something custom?** Custom OpenClaw agents & skills starting at $500. If you can describe it, I can build it. → [Hire me on Fiverr](https://www.fiverr.com/s/jjmlZ0v)
18816132863