.env files are the right place for secrets – but only if they are not committed by accident and don't hold keys that really belong on the server. That is exactly what this check looks at.
What it does
Env Clinic reads your .env variants (.env, .env.local, .env.production …) and rates every finding in context. A secret in a local .env is less critical than the same value in source code – the traffic light reflects that.
Why it matters
The most common mistake is putting a Supabase service_role key or a private Stripe key somewhere it can reach the frontend. Env Clinic catches these mix-ups and explains where the key really belongs.
How to use it
The .env check runs automatically with every scan. You don't need to do anything extra.
env-clinic scan .
- Detects all common .env variants
- Rates findings by context
- Warns about frontend/server mix-ups