Over weeks, keys pile up in .env files, in code, on Vercel, on Supabase and in notes. At some point nobody knows which key is active where – and which should have been rotated long ago.
What happens
Keys are scattered across several files, services and heads. There is no single place that shows what is used where.
Why it's dangerous
Without an overview, old or leaked keys stay active because nobody knows they still exist. Those forgotten keys are exactly the ones exploited later.
How Env Clinic helps
A local scan lists every key it finds in one place, redacted and with a risk traffic light – your quick overview before launch.
env-clinic scan . --html
- One overview of all findings
- Risk traffic light and Launch Score
- Local HTML report to archive