Download
FeaturesSecurityPricingDownloadFor vibe coders
Local security checkOpen Source · MIT

Find API keys, understand the risk, launch safely.

Env Clinic scans your project locally for risky .env files, leaked secrets and missing protection rules. You get clear fix steps, without uploading any real API keys.

Set up a local scanSee the security model
Runs locally on your deviceReal secrets are redactedNo cloud analysis in V1
env-clinic
$ env-clinic scan .
Safety: local only · secrets redacted · network: no
[critical] OpenAI API Key src/config.ts:12
sk-proj-...A9xQ
[critical] Stripe Secret .env:4
Launch Score: 35 / 100 — Do not launch
  • Runs locally on your device
  • Real secrets are redacted
  • No cloud analysis in V1
  • No telemetry
  • No LLM/API calls
  • Built for vibe-coding projects

What is Env Clinic – and who is it for?

Env Clinic is a local security check for API keys and .env files. You run it with one command in your project, get a clear risk overview and concrete fix steps – before you launch.

What it is

A small, local command-line tool. It scans your project files, shows risky keys redacted and explains what to do. No cloud, no account.

Who it is for

For vibe coders, solo founders and small teams who build fast and want to launch safely – even without a security background.

Why now

AI tools like Claude and Codex produce code in minutes. Secrets scatter just as fast. A quick check before launch saves you from costly leaks.

Your API keys are scattered everywhere

When you build fast, secrets quickly end up in places they don't belong. That's normal – and exactly what Env Clinic checks for you. Click a risk to understand what happens and how to fix it.

API key right in the code

An API key sits directly in the code instead of an environment variable.

.env committed to Git by accident

The .env file got added to Git by accident.

Key in a chat or screenshot

A key was copied into a chat, a ticket or a screenshot.

Real key in the README

A real test key is still sitting in the README.

service_role key in the frontend

A Supabase service_role key lives in the frontend, when it belongs only on the server.

Lost track of the keys

Nobody knows anymore which key is used where.

How Env Clinic works

  1. 1

    Scan your project locally

    You run Env Clinic inside your project folder. Everything happens on your device.

    env-clinic
    $ env-clinic scan .
    Scanning 42 files · local only · network: no
  2. 2

    See secrets redacted

    Env Clinic only shows found keys shortened, for example sk-proj-...9xyz. The full value never appears.

    env-clinic
    [critical] OpenAI API Key src/config.ts:12
    Value: sk-proj-…A9xQ (redacted)
  3. 3

    Understand the risk

    A simple traffic light shows you what's harmless and what needs an immediate fix.

    env-clinic
    critical 1 high 1 medium 1 low 0
    Launch Score: 35 / 100 — Do not launch
  4. 4

    Apply the fix steps

    Each finding comes with clear guidance: what to do, whether to rotate, and where the key belongs.

    env-clinic
    Fix: remove the key, rotate it at the provider,
    store it as a server-side env var · Rotate: yes
  5. 5

    Scan again

    You run another scan and watch your Launch Score go up.

    env-clinic
    $ env-clinic scan .
    Launch Score: 100 / 100 — Good

What Env Clinic does

Local Secret Scan

Finds API keys and secrets in your project files - fully local.

Mehr erfahren

.env Safety Check

Checks your .env files for risky contents and mix-ups.

Mehr erfahren

.gitignore Check

Tells you whether your .env files are really protected from Git, and gives you the missing lines.

Mehr erfahren

Git History Scan

Optionally searches your local Git history for old leaks too.

Mehr erfahren

Safe .env.example

Creates a clean .env.example - variable names only, no real values.

Mehr erfahren

Launch Score

A 0-to-100 score shows at a glance whether you're ready to launch.

Mehr erfahren

Beginner Fix Instructions

Plain-language explanations instead of cryptic security jargon.

Mehr erfahren

HTML/JSON Report

Local reports to read or process further - with no external content.

Mehr erfahren

Your safety promise

Env Clinic is built so your real secrets never leave your device.

No Secret Upload

Real secrets are never uploaded. The scan runs only locally on your machine.

No Telemetry

No trackers, no analytics, no hidden statistics.

No External Assets

The reports load no external fonts, images or scripts.

No LLM Calls

Env Clinic sends your code to no AI and no external API.

Canary Tests

Automated tests verify that no real secret value ever ends up in a report.

Local Reports

All reports stay local in your project. You keep full control.

Open source

Trust through transparency

The core of Env Clinic is open source. Read every line yourself and see for yourself: no hidden network calls, no telemetry, nothing leaves your device.

View the source on GitHub
  • Every line auditable
  • No network calls in the code
  • MIT licensed – free to use

Verifiable trust

Env Clinic relies on verifiable trust: the scanner runs locally, real secrets are redacted, and the open core can be inspected. Releases are meant to ship with checksums and build attestations.

  • Local scan
  • No secret upload
  • Open scanner core
  • Redacted reports
  • Canary tests
  • SHA-256 checksums
  • Build attestations (planned)
  • npm provenance (planned)
  • Signatures optional later
Inspect the source

Pricing

Env Clinic starts free and local. Advanced features come later.

Free Local

Free

The full local scanner.

  • Local Secret Scan
  • .env & .gitignore Check
  • Launch Score
  • HTML/JSON Report
Download
★

Pro Reports

Later

Extra reporting features for teams and recurring checks.

  • Advanced reports
  • History over time
  • More provider rules
Download

Team / Cloud

Waitlist

A later optional cloud version - always without real secrets.

  • Team overview
  • Redacted data only
  • Early access via waitlist
Download

Use Env Clinic the way that fits you.

Start with the download build, use the CLI, or inspect the open core on GitHub. The principle stays the same: real secrets are never uploaded.

Download build for beginners

Get the build for your system, run the local scan and get a clear report – without uploading API keys.

Go to download

CLI for developers

Scan your project right in the terminal – no install needed: npx @panart/env-clinic scan . The open core lives on GitHub.

On GitHub

GitHub Releases coming soon

Verified artifacts and checksums, once releases are available.

View releases

Open scanner core

Inspect the scanner, the redaction logic and the security model right in the repository.

View the source

Download Env Clinic

Get the build for your system. No Node.js required.

How to run it: Env Clinic is a terminal tool. A double-click only briefly shows the help and closes again right away. Open a terminal, unzip the file, change into your project folder and run:

env-clinic scan .

macOS/Linux: after unzipping, make it executable with chmod +x env-clinic. The builds are not signed yet – hence the security prompt on first launch.

Frequently asked questions

Are my API keys sent anywhere?
No. Env Clinic runs fully locally, makes no network calls and only shows redacted values. You can verify it yourself: env-clinic scan --offline-proof.
What does rotating mean?
Rotating means: delete the old key at the provider and create a new one. Just changing the value in your code is not enough - the old key keeps working otherwise.
It flagged an example value. Is that bad?
Env Clinic tries to ignore obvious placeholders. If a real-looking sample slips through, rename it clearly as a placeholder, for example your_api_key_here.
Why is a Supabase service_role key always critical?
Because it bypasses security rules and grants full database access. It belongs only in a secure server environment, never in the frontend or a README.
Do I need coding skills?
You just run one command in your project folder. The explanations are written for beginners.
Does this replace a security audit?
No. Env Clinic is a helpful first check before launch, but not a replacement for a professional security review.

Ready to fix your API key chaos?

Get your secrets in order before you launch. Local, redacted and with no upload.

Set up a local scan