AllEnv 🛡️ — Beginner-Proof .env Security & Editor for VS Code

Stop leaking API keys on Zoom/Discord, stop pushing .env to GitHub, and edit dev vs. prod configs safely in seconds.

Every feature below works right out of the box with zero external runtime dependencies and zero telemetry — your secrets never leave your computer.

⚡ How to Start (Takes 10 Seconds)

You don't need to configure anything after installing AllEnv:

1. Open any .env file in VS Code (.env, .env.local, .env.production, .env.staging, etc.).
2. AllEnv turns on automatically:
   • All secret values are immediately hidden behind dots (••••••••••••) on screen — your actual file on disk is NOT modified.
   • Look at the bottom-right Status Bar: you will see 🛡️ Shield: ON and your trial/license status.
3. To copy or peek at a secret safely while screen-sharing:
   • Hover your mouse over any masked value (••••••••••••).
   • Click Copy Secret (copies directly to your clipboard without showing it on screen) or Reveal (5s) (shows just that one secret for 5 seconds, then hides it again).
4. To temporarily show/hide everything:
   • Click 🛡️ Shield: ON / OFF in the bottom Status Bar, or press Ctrl + Alt + S (Windows/Linux) / Cmd + Alt + S (Mac).

Note: Template files like .env.example, .env.sample, and .env.template are intentionally left visible so teammates can read sample keys easily.

🧭 Where Every Button Lives (Cheat Sheet)

When any .env file is open, you have 3 easy ways to launch AllEnv tools:

1. Top-Right Editor Icons (above your .env tab):
   • Table icon → Open Visual Table Editor
   • Shield icon → Toggle Shield Mode (Masking ON/OFF)
   • Diff icon → Open Compare Environments (Dev vs Prod)
2. Right-Click Menu inside any .env file → all AllEnv actions appear together.
3. Command Palette (Ctrl + Shift + P / Cmd + Shift + P) → type AllEnv: to see every command.

🛠️ Step-by-Step Guide to Every Feature

1. 🛡️ Shield Mode (Screen-Share Safe Mode) — Free Forever

• Problem it solves: You are on a Zoom/Google Meet/Discord call and open .env, exposing Stripe/OpenAI/AWS keys.
• How to use it:
  1. Open .env. Secrets are masked automatically as ••••••••••••.
  2. Hover over a line to see how long the secret is, copy it blindly, or reveal it for 5 seconds.
  3. Toggle anytime with Ctrl + Alt + S (Cmd + Alt + S on Mac) or click 🛡️ Shield: ON in the bottom Status Bar.

2. 🔒 Git Leak Protection — Free Forever

• Problem it solves: Accidentally running git add . and pushing your .env secrets to GitHub.
• How it solves it:
  1. AllEnv automatically checks .gitignore and Git's tracked files (git ls-files).
  2. If your .env is unprotected or already tracked, AllEnv warns you right away.
  3. Click the 1-Click Quick Fix (or run AllEnv: Add .env to .gitignore) to safely add .env* rules while keeping !.env.example tracked.
  4. Run AllEnv: Check Git Leak Protection anytime from the Command Palette to double-check your repo.

3. 🧹 .env Linter & Formatter — Free Forever

• Problem it solves: Broken .env files caused by duplicate keys (PORT=3000 twice), missing =, spaces around =, or unquoted spaces in values.
• How to use it:
  • Linter: Watch for yellow/red squiggles on duplicate keys or syntax mistakes; press Ctrl + . (Cmd + .) for a 1-click Quick Fix to remove or comment out duplicates.
  • Formatter: Right-click inside .env → AllEnv: Format .env File (or press VS Code's standard Shift + Alt + F / enable Format on Save).

4. ⚡ .env ↔ .env.example Schema Drift Sync — Free Forever

• Problem it solves: You add STRIPE_WEBHOOK_SECRET to .env, forget to add it to .env.example, and your teammate's build crashes.
• How to use it:
  • AllEnv underlines keys that exist in .env but are missing from .env.example (and vice versa).
  • Press Ctrl + . (Cmd + .) on the squiggle to add the missing key name safely without copying your real secret value.
  • Or run AllEnv: Sync Missing Keys to .env.example / AllEnv: Pull Missing Keys from .env.example from the Command Palette.

5. 📊 Visual .env Table Editor — Pro (Included in 30-Day Trial)

• How to use it:
  1. Open any .env file and click the Table icon in the top-right toolbar (or run AllEnv: Open Visual Table Editor).
  2. View, edit, add, delete, search, or A–Z sort variables in a clean spreadsheet UI — edits sync live to your .env file.
  3. Need a strong new secret/JWT key? Click Generate Secret inside the editor to create a random cryptographic token in 1 click.

6. ⚖️ Environment Comparator (.env vs .env.production) — Pro (Included in 30-Day Trial)

• How to use it:
  1. Click the Diff icon in the top-right toolbar (or run AllEnv: Compare Environments (Dev vs Prod Diff)).
  2. Pick Environment A (e.g. .env) and Environment B (e.g. .env.production).
  3. AllEnv highlights missing keys, matching keys, and different values side by side, with 1-click buttons to sync missing keys over.

7. 🚨 Point-of-Commit Secret Matcher in Source Code — Pro (Included in 30-Day Trial)

• Problem it solves: Someone pastes a real API key directly inside app.ts or config.py instead of using process.env.
• How it works automatically:
  1. AllEnv watches your code files (.js, .ts, .py, .go, .java, etc.) against values defined in your .env.
  2. If a real secret value from .env appears hardcoded in code, AllEnv flags it with an error squiggle immediately.
  3. Press Ctrl + . (Cmd + .) → AllEnv replaces the hardcoded string with process.env.YOUR_KEY (or os.getenv('YOUR_KEY') in Python).

🆓 Free Forever vs. 🚀 AllEnv Pro (30-Day Trial)

New installs start with an automatic 30-Day Free Pro Trial (no credit card or signup needed). After Day 31:

🔑 How to Buy, Activate & Move Your License

1. Open Command Palette (Ctrl + Shift + P) → AllEnv: Pricing & Upgrade to Pro (early bird code LAUNCH30 gives 30% off: Solo Dev 2 seats, Lifetime 3 seats, Team 10 seats).
2. After purchase, copy your Gumroad license key (XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX).
3. Run AllEnv: Enter License Key (or paste it inside the Pricing & License tab) → click Activate.
4. Works Offline: Once activated, your machine stays unlocked 100% offline with no repeated prompts.
5. Moving to a New PC? Run AllEnv: Deactivate License on This Machine on the old PC to free up that seat immediately.

❓ Quick Troubleshooting & FAQ

• Did AllEnv actually edit my .env file and replace my secrets with dots (••••)? No! Masking is visual-only inside VS Code. Your real .env file on disk is completely untouched.
• Can I reveal only certain non-sensitive variables (PORT, NODE_ENV) and mask only passwords/tokens? Yes! Open VS Code Settings (Ctrl + ,) → search allenv.shieldMode.maskAllValues and uncheck it.
• I changed my OS clock or got a Clock Tamper warning — did I lose my work? Your .env files and Free features always keep working. If your PC clock simply drifted offline within the trial period, setting your system clock back to the real time (or reloading online) automatically heals your active trial.

⚙️ Settings Reference (Ctrl + , → Search AllEnv)

License

MIT © 2026 PandaScrub (https://pandascrub.dev). All rights reserved.