EnvGuard: Secret Leak Prevention & .env Inspector 🛡️

Real-time API key and secret leak detector, missing .env variable linter, and 1-click .env.example generator for VS Code.
Prevent career-ending credential leaks before they ever reach GitHub or production!

🛡️ Why EnvGuard?

Accidentally committing sensitive credentials (OpenAI keys, AWS credentials, Stripe tokens, private keys) to public git repositories happens to thousands of developers every day. It results in compromised cloud accounts, thousands of dollars in surprise bills, and major security breaches.

Furthermore, managing .env files across team members often results in missing environment variables that break applications at runtime.

EnvGuard provides an active, real-time security shield inside VS Code:

1. 🚨 Real-Time Secret Detection: Instant red warning banners whenever an API key or secret token is pasted or hardcoded in source code.
2. ⚡ 1-Click Quick Fix ("Move to .env"): Extracts hardcoded credentials to .env and swaps the code with the proper environment variable accessor (process.env.VAR, os.getenv('VAR'), etc.).
3. 📄 1-Click .env.example Sync: Automatically generates or synchronizes your .env.example template with clean placeholders, keeping secrets safe.
4. 🔍 Missing Variable Validator: Flags any process.env.KEY or os.getenv('KEY') in your code that is missing from your .env configuration.
5. 📊 Workspace-Wide Security Audit: Scans your entire project tree for exposed secrets with a single command.

🌟 Key Features

1. 🔍 Comprehensive Secret Detection Engine

EnvGuard's regex pattern engine detects high-risk credentials across all programming languages:

• OpenAI & Anthropic: sk-..., sk-proj-..., sk-ant-...
• Google Cloud & Gemini: AIza... API keys
• Amazon Web Services (AWS): AKIA... & ASIA... access keys and secret access keys
• GitHub: Personal Access Tokens (ghp_..., github_pat_...)
• Stripe: Live and test secret API keys (sk_live_..., rk_live_...)
• Slack & SendGrid: Webhook and Bot tokens (xoxb-..., SG....)
• Cryptographic Keys: RSA, EC, OpenSSH, PGP private key headers
• JWT Tokens & Generic Credentials: Passwords, client secrets, and hardcoded tokens

2. ⚡ Intelligent Quick-Fix Code Actions

When a secret is detected:

• Click the lightbulb 💡 or press Ctrl + . (Cmd + .).
• Choose "Move hardcoded secret to .env": EnvGuard prompts for a variable name, appends it securely to .env, and replaces the code automatically!
• Or choose "Ignore false positive" to add an inline // envguard-ignore tag.

3. 📄 1-Click .env.example Generator (Alt + Shift + E)

Keep your repository ready for onboarding and open-source contributors without exposing private secrets. EnvGuard parses your active .env and generates clean dummy values (your_api_key_here, 3000, postgresql://...) while preserving existing template comments.

4. ⚠️ Missing Variable Linter

Never push code that crashes in staging due to missing environment variables. EnvGuard statically analyzes your codebase and alerts you if any referenced variable does not exist in your local .env.

⌨️ Keyboard Shortcuts & Commands

⚙️ Configuration

You can customize EnvGuard in VS Code Settings (Ctrl + , / Cmd + ,):

{
  // Enable or disable real-time background scanning as you type
  "envguard.enableRealTimeScanning": true,

  // Enable or disable missing variable linting
  "envguard.checkMissingEnvVariables": true,

  // Diagnostic severity: "Error" | "Warning" | "Information"
  "envguard.secretSeverity": "Error",

  // Name of the template file
  "envguard.exampleFileName": ".env.example"
}

👨‍💻 Author & Connect

Developed with ❤️ by Pirapaakaran Pirathapan.

• 💼 LinkedIn: pirapaakaran-pirathapan
• 🌐 Facebook: pirapaakaranpirathapan

If you find this extension helpful, please consider leaving a ⭐⭐⭐⭐⭐ review on the VS Code Marketplace!

📄 License

MIT License © 2026 Pirapaakaran Pirathapan.