Input

# .env (sample data: every value below is synthetic)
APP_ENV=production
DATABASE_URL=postgres://app_user:Zq7mK2vRx9LwTf4N@db.internal.example.net:5432/appdb
REDIS_URL=redis://:r3d1sPa55w0rdXyQ8@cache.internal:6379/0
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
STRIPE_SECRET_KEY=sk_live_Zt4nR8vK2mQx7LbW9cYd3HfA
GITHUB_TOKEN=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
OLD_GITHUB_TOKEN=ghp_Q7m2XvB9nLk4RtY1cZa8WdE3sHf6JuAAAAAA
ANTHROPIC_API_KEY=sk-ant-api03-Hk3Jd9Qw2Lm7Xv5Rt8Yb1Nc4Zp6Sa0Fg3Uo9Ie2Kj5Wh8Td1Qr4Vm7Xc0Bn3Lz6Pa9Ys2Ef5Gu8Ho1Jk4
SLACK_WEBHOOK=https://hooks.slack.com/services/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
SESSION_SECRET="k8Jd92LmXq0PvR7tYb3NcZ5aWe1UoHs4"
JWT_SECRET=your-secret-here
API_KEY=${API_KEY}

# curl from a ticket
curl -H "Authorization: Basic ZGVwbG95OlRyMHViNGRvciYzeEs5" https://api.example.com/v1/deploys
curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IlNhbXBsZSBVc2VyIiwiaWF0IjoxNTE2MjM5MDIyfQ.c2FtcGxlLXNpZ25hdHVyZS1ub3QtcmVhbA" https://api.example.com/v1/me

// config.js
const config = {
  password: "Sup3r$ecretP@ssw0rd-2024",
  apiKey: process.env.API_KEY,
  timeout: 30,
};

Contact: jane.doe@corp.example.org  host: 10.12.34.56

1,517 chars33 lines

Redacted copy

Style

0 redacted

Pattern-based: it finds what it has rules for and can miss custom or obfuscated secrets, so review the text before sharing. Always rotate any real secret that was exposed. Everything runs locally in your browser; nothing is uploaded. Inputs over 5,000,000 characters are truncated. The findings JSON contains masked previews and fingerprints, never raw values.

Secret Scanner & Redactor

Command Palette