Secret & Env Var Sentinel
Scans your workspace for hardcoded secrets, API keys, and risky environment-variable
usage, and flags them inline as diagnostics and in a summary report. Runs entirely
locally — no data ever leaves your machine.
Features
- Live diagnostics: as you open, edit, or save files, detected secrets are
underlined and listed in the Problems panel.
- Workspace scan: run
Secret & Env Var Sentinel: Scan Workspace for Secrets from the
Command Palette to scan source and configuration files (excluding prose
documentation, node_modules, .git, and build output) and get a full report
in the "Secret & Env Var Sentinel" Output channel.
- Detects common secret formats: AWS access keys, GitHub/Slack/Stripe/Google
tokens, PEM private key blocks, JWTs, and generic
key = "..." assignments.
.env file awareness: flags empty or placeholder values (e.g. changeme)
in .env-style files, and warns when a real .env file (not .env.example)
doesn't appear to be covered by .gitignore.- Redacted output: matched values are always masked (e.g.
AKIA****3F2A) in
diagnostics and reports — the real secret is never displayed or logged in full.
- Status bar indicator: shows the live count of findings; click it to jump
to the Problems panel.
- Sidebar findings view: an Explorer panel ("Sentinel Findings")
lists every issue grouped by file with a plain-English explanation; click one
to jump straight to that line.
- Undefined environment variable detection: flags
process.env.X,
Python's os.environ/os.getenv, and Terraform's var.x references that
aren't defined in any .env, .tf (variable "x" {}), or .tfvars file in
the workspace. process.env/os.environ usages are also checked against your
system/OS environment (Terraform variables are not, since they're supplied via
.tfvars/-var/defaults, not the OS environment). Usages that already provide
a fallback default (e.g. process.env.PORT || 3001, os.getenv("NAME", default))
are skipped, since they can't be undefined.
- Unset-on-this-machine warnings: if a variable is documented in the project
(e.g. listed in
.env.example) but has no real value in your current shell/OS
environment, it's flagged separately so you know to set it before running.
- Ignores downloaded/vendored dependencies: files under
.terraform/ (Terraform
modules pulled in by terraform init), node_modules/, vendor/, .venv/venv/,
and __pycache__/ are never scanned, live or in a workspace scan — that's someone
else's source, not yours. Any .tf/.tfvars file under a modules/ directory is
also treated as module source and skipped, whether the module is local, git, or
registry-sourced.
Usage
- Open a workspace.
- Findings appear automatically in the Problems panel as you work.
- Run
Secret & Env Var Sentinel: Scan Workspace for Secrets from the Command Palette
(Cmd+Shift+P) to scan the entire workspace at once.
Requirements
None — works out of the box.
Extension Settings
secretsEnvScanner.disabledPatterns: array of pattern IDs to disable (e.g.
"aws-access-key", "generic-api-key").secretsEnvScanner.excludeGlob: glob of files/folders to skip during workspace
scans. Defaults to node_modules, .git, and common build output folders.
Common prose documentation files such as README.md are always skipped.secretsEnvScanner.maxFileSizeKB: maximum file size (KB) to scan; larger files
are skipped. Defaults to 1024.
Known Issues
- Detection is regex-based and may produce false positives/negatives; review
findings before acting on them.
- Binary files and files larger than 1 MB are skipped during workspace scans.
Release Notes
0.0.1
Initial release: secret pattern detection, live diagnostics, workspace scan
command, and .env file checks.
Enjoy!
| |
