Data & Requests · LOCAL TOOL

.env Hygiene Review

Review pasted environment-file text for duplicate keys, malformed assignments, unmatched quotes, and names that commonly hold credentials.

Runs in this page
No API call

WORKSPACEINPUT → RESULT

Your input

LOCAL

Result

Run the tool to see a result.

Your result will appear here. Input is not saved.

Browser-side processingNothing is sent to a tool API.

WHY THIS TOOL EXISTS

A focused job, not a black box.

The report lists line numbers and key names while avoiding printing values in its findings. It helps catch file hygiene issues before a local configuration is committed.

How to use it

Paste a bounded environment-file excerpt.
Run the scan and review line-specific findings.
Fix the source file locally; this page does not save the input.

TRY A WORKING EXAMPLE

Start with known input.

Load this sample into the workspace, run the tool, and compare the result shown below.

Show sample input

{
  "env": "APP_MODE=development\nAPI_TOKEN=replace-me\nAPP_MODE=preview\nBROKEN-KEY=value\nDB_PASSWORD=\"unterminated"
}

Expected sample result from the local tool

5 assignment(s) reviewed · 5 finding(s).

Line 2 · API_TOKEN · Sensitive-looking key name; review storage and commit handling. Value not displayed.
Line 3 · APP_MODE · Duplicate key; first assignment is on line 1.
Line 4 · BROKEN-KEY · Key does not match a common environment-variable name form.
Line 5 · DB_PASSWORD · Value begins with a quote that has no matching closing quote.
Line 5 · DB_PASSWORD · Sensitive-looking key name; review storage and commit handling. Value not displayed.

Values are intentionally omitted from findings. Key-name matching is heuristic and cannot establish whether a secret is present.

LIMITS AND INTERPRETATION

What the result cannot tell you.

Name matching is a heuristic, not a secret detector. It cannot determine whether a value is real, compromised, or safe to commit.

Inputs are processed in this page and are not written to local storage.