Secrets Management Auditor for Deployment Scripts

WHAT IT DOES

Secrets Management Auditor for Deployment Scripts scans your deployment scripts, environment variable files, and configuration files for hardcoded secrets, private keys, API tokens, passwords, and other sensitive patterns. It analyzes the text you paste and flags any line that contains a potential secret—whether it's an Ethereum private key (0x followed by 64 hex characters), a 64-character hex string, an environment variable assignment that looks sensitive (like PRIVATE_KEY=...), or any custom pattern you define. The tool reports findings with line numbers, severity levels (high or medium), and the specific match that triggered the alert. It provides a summary dashboard showing total findings, high-severity issues, medium-severity issues, and the number of unique pattern types detected. This helps developers, DevOps engineers, and security teams catch secrets before they are committed to version control or exposed in production.

HOW TO USE

Paste your deployment script, .env file, or any configuration file into the main textarea. Optionally, add custom secret patterns in the second textarea—one pattern per line—to catch project-specific secrets. Click "Audit for Secrets." The tool analyzes the text line by line, checking for known sensitive patterns and any custom patterns you provided. It displays results as a summary dashboard and a detailed list of findings. Each finding shows the line number, the matched secret or pattern, a severity tag, and the pattern type. If no secrets are found, the tool reports a clean audit. You can use this before committing code, before deploying to production, or as part of your security review process to ensure no secrets are accidentally exposed.

THE REAL MECHANISM

The tool uses a multi-pass scanning approach entirely in the browser. It first compiles a list of patterns—both built-in and user-provided—into regular expressions. It then splits the input text into lines and scans each line for Ethereum private key patterns (0x followed by exactly 64 hex characters), 64-character hex strings that are not all digits, and environment variable assignments (key=value) where the key contains sensitive substrings like PRIVATE_KEY, SECRET, API_KEY, PASSWORD, MNEMONIC, TOKEN, or similar. For each match, the tool records the line number, the matched content, and assigns a severity: "high" for private keys and explicit sensitive environment variables, and "medium" for pattern-based matches. The tool also detects .env style exports (export KEY=value). All scanning is done client-side with no data sent to any server. The tool does not attempt to validate whether a detected string is actually a secret—it flags any match as a potential risk, leaving the user to verify.

WHAT IT CANNOT SEE

This tool cannot detect secrets that are stored in encrypted form or obfuscated—it only scans plain text. It cannot audit secrets that are not present in the provided files—if a secret is stored elsewhere, the tool will not flag it. It cannot detect if a secret has been previously exposed in transaction history, version control history, or logs. It cannot verify that a secret is properly rotated or that it follows security best practices. It cannot detect secrets that are passed via command-line arguments, interactive prompts, or environment variables that are not shown in the pasted files. It cannot detect secrets that are constructed dynamically (e.g., through string concatenation) unless the resulting value matches a pattern. It cannot determine if a detected key is a test key or a real production key—it flags both. It cannot scan binary files or files that are not plain text.

PLEASE NOTE

Secrets Management Auditor works entirely client-side and does not require a blockchain connection to function, though the network selector is provided for context. It is a security tool for developers, not an on-chain tool. It reads data only and does not send any information to external servers. The tool is free to use and does not require authentication. Always use a secrets manager or environment variables for sensitive values—never hardcode secrets in source code.