HOW TO SCAN & AUDIT .ENV FILES FOR LEAKED API KEYS & SECRETS

Accidental credential leaks in Git repositories cost businesses millions of dollars every year. When developing applications locally, developers often store sensitive keys in .env files that risk getting committed to GitHub or GitLab.

1. TOP HIGH-RISK CREDENTIALS DETECTED

• Live Stripe API Keys: Keys starting with sk_live_... that grant full access to charge credit cards and view customer balances.
• OpenAI Project Tokens: Tokens starting with sk-proj-... that can trigger unlimited API billing if leaked.
• AWS Secret Access Keys: High-privilege IAM credentials that grant cloud infrastructure access.
• Weak JWT Secrets: Passphrases shorter than 32 characters susceptible to offline brute-force attacks.
• Default Database Passwords: Credentials like postgres, root, or password123.

2. BEST PRACTICES FOR SECRET HYGIENE

1. Always add .env and *.local.env to your root .gitignore file.
2. Maintain a sanitized .env.example with dummy placeholder values.
3. Run local audit scans before every production deployment.