Local Secret Scan
Finds API keys and secrets in your project files – fully local.
Env Clinic walks your project folder file by file, looking for patterns that look like real keys: OpenAI, Anthropic, Stripe, Supabase, GitHub and more than a dozen others. Everything happens on your device – nothing is uploaded.
What it does
The scanner reads your .env files, source code, README and config files and matches them against conservative patterns for known providers. When a match is uncertain, Env Clinic flags it as a "possible secret" rather than missing it.
Why it matters
An API key sitting in your code or README is like the house key under the doormat. Anyone who sees the code – in a public repo, a screenshot or a chat – has instant access. You want to find those spots before someone else does.
How to use it
One command in your project folder is enough. Found values are only ever shown shortened, for example sk-proj-…9xyz.
env-clinic scan .
- Runs locally, no upload
- Real values are redacted
- Detects 15+ providers plus generic patterns