DeploySafe

Scan your PHP/web project for exposed secrets, hardcoded credentials, and leftover debug settings — before you deploy, not after.

Runs entirely locally: DeploySafe reads files from your workspace and never sends anything over the network. No telemetry, no external service.

What it checks (MVP)

• Secrets: AWS access keys, GitHub tokens, Slack tokens/webhooks, Stripe live keys, Google API keys, generic API key/token assignments, private key blocks, plus a generic high-entropy string check for secrets that don't match a known format
• PHP credentials: hardcoded DB_PASSWORD, mysqli_connect()/PDO connection strings
• Debug flags left on: WP_DEBUG, APP_DEBUG, display_errors, leftover var_dump/print_r
• Sensitive files present: .env, .git/, SQL dumps, .bak files, phpinfo.php
• WordPress: wp-config.php security keys left at their default placeholder, security keys/salts that duplicate each other's value, default $table_prefix

Usage

Run "DeploySafe: Scan Project for Issues" from the Command Palette, or right-click a folder in the Explorer. Results appear in the Problems panel — click an entry to jump straight to the line.

Reducing false positives

Two ways to exclude files/folders from scans:

• A .deploysafeignore file at the workspace root, one pattern per line (# for comments) — e.g. uploads/, *.log, tests/fixtures/
• The deploySafe.exclude VSCode setting (array of the same kind of patterns)

These aren't full .gitignore syntax (no negation, no anchoring) — just plain folder/file names or simple globs.

Known limitations

• Detection is regex/heuristic-based, not a real PHP parser — expect occasional false positives (flag something that isn't actually a secret) and false negatives (miss an unusual format). Treat findings as leads to review, not a certified audit.
• The generic high-entropy check is a heuristic tuned to cut down noise, not a guarantee — it can still miss custom secret formats or, rarely, flag a random-looking string that isn't one.
• No inline "ignore this line" comment yet — exclusions are whole file/folder only, via .deploysafeignore or deploySafe.exclude.
• Scans the whole workspace on each run (no incremental/watch mode); it's a manual command by design for this version.
• No dependency vulnerability (CVE) scanning, and WordPress checks are limited to wp-config.php — no plugin/theme vulnerability database yet.

Roadmap

Deeper checks (dependency vulnerabilities, code quality, project architecture graph, Laravel-specific rules) are planned for a future paid tier.