EnvLens
Find leaked secrets and bad config before you commit.
EnvLens checks a .env, yaml, or toml config for leaked secrets and insecure settings, maps findings to common weakness types, and hands you a remediation checklist before you commit.
Paste a .env, yaml, or toml config and EnvLens flags leaked secrets (keys, tokens, passwords), insecure settings, and gives a remediation checklist mapped to common weakness types.
What it checks
- Detect leaked keys / tokens / passwords
- Flag insecure settings
- Map findings to weakness types
- Give a remediation checklist
How does EnvLens find leaked secrets?
Paste a .env, yaml, or toml config and it detects leaked keys, tokens, and passwords plus insecure settings. Catching them before commit stops a secret from ever reaching the repo.
Does it map findings to weakness types?
Yes. It maps each finding to common weakness types, so the issue is named in terms security reviewers recognize, not just flagged as 'bad'.
What do I get to fix it?
It returns a remediation checklist, turning a scan into an actionable list you can work through before pushing.
Who is EnvLens for?
It fits developers who want a fast secret-and-config sanity check in their workflow without standing up a full security scanner.
When EnvLens is the wrong tool for the job
EnvLens focuses on a single job: Find leaked secrets and bad config before you commit. It automates one small step, but it is not a substitute for testing and review. Check its output against your real setup before you rely on it.
What a single scan covers
- Detects leaked keys/tokens/passwords
- Maps to weakness types
- Remediation checklist
Questions about findings and false positives
What is EnvLens?
EnvLens is a config scanner that flags leaked secrets and insecure settings in .env, yaml, or toml files and gives a remediation checklist.
Which files does it read?
It accepts .env, yaml, and toml config files.
What does it detect?
It detects leaked keys, tokens, and passwords plus insecure settings.
Does it name the weakness type?
Yes. Findings are mapped to common weakness types for clearer review.
What do I get to fix issues?
A remediation checklist you can work through before committing.
Who should use it?
Developers who want a quick secret-and-config check before pushing code.
When should you not rely on EnvLens?
Not a replacement for proper testing, CI, and code review. Validate generated code, schemas, and regexes against your real inputs before shipping.
Who is EnvLens for?
EnvLens is built for engineers and small teams who need this exact job done: Find leaked secrets and bad config before you commit.
Built by Xingliang Li · LX Micro-SaaS Factory — a one-person, curated set of tight-vertical AI tools. How tools are selected →