S
Supanote
Sign in Sign up
Security · Zero Signup Required

Online .env, Log & API Key Secret Scanner

Audit `.env` files, CI logs, curl commands, and stack traces for accidental credential exposure. Review matched secret patterns and PII counts, scrub every token in one click with `[REDACTED_*]` placeholders, and share safely.

9 lines · 508 B
Live Output Ready
5 secrets · 3 PII items
High-Severity Credentials Detected (5)
  • AWS Access Key AKIAIOSFODNN7EXAMPLE
  • JSON Web Token (JWT) eyJhbGciOiJIUzI...Qssw5c
  • Authorization Bearer Token Authorization: ...Qssw5c
  • Slack API Token xoxb-4910283910...le9912
  • Database Connection URI with Credentials postgres://app_...orders
PII Signals
Email Address: 2 IP Address: 1
Sanitized Preview (Ready to Share Safely)
# Staging service configuration (synthetic sample tokens)
NODE_ENV=production
PORT=8080
AWS_ACCESS_KEY_ID=[REDACTED_AWS_KEY]
DATABASE_URL=postgres://app_admin:[REDACTED_PASSWORD]@ss99@db-prod.internal:5432/orders
AUTH_HEADER="Authorization: Bearer [REDACTED_TOKEN]"
SLACK_BOT_TOKEN=[REDACTED_SLACK_TOKEN]
ONCALL_CONTACT=sre-alerts@example.com
UPSTREAM_NODE=198.51.100.44
Terminal / CI Pipe Equivalent 
sed -E "s/(SECRET|TOKEN|PASSWORD)=.*/\1=[REDACTED]/g" .env | curl --data-binary @- https://supanote.app/paste

Sanitize local environment configs before piping to a shareable diagnostic link.

Capabilities & Guarantees

  • ✓ Detects AWS `AKIA*` keys, PEM private keys, JWTs, GitHub `ghp_*` PATs, and Slack `xox*` tokens
  • ✓ Flags embedded `postgres://`, `mysql://`, `mongodb://`, and `redis://` connection passwords
  • ✓ Counts low-severity PII exposure (emails and public IPv4 addresses) separately
  • ✓ One-click "Redact All Secrets" replaces live credentials with safe `[REDACTED_*]` markers

Common Engineering Workflows

Sanitizing `.env` Files Before Asking for Debugging Help

Strip live database passwords and API keys while keeping variable names and structure intact for teammates or AI coding assistants.

Pre-Flight Check for cURL Commands & HTTP Traces

Catch forgotten `Authorization: Bearer ...` and `Cookie: sid=...` headers copied from browser DevTools Network tabs.

Auditing Incident Stack Traces Before Public Postmortems

Verify that serialized error objects and query logs contain zero connection credentials or customer emails.

Technical Questions & Details

What types of credentials does the Secret Scanner detect?

It scans for AWS Access Keys (`AKIA...`), PEM cryptographic private keys, JSON Web Tokens (`eyJ...`), Bearer headers, GitHub PATs (`ghp_...`), Slack tokens (`xoxb-...`), credentialed DB URIs, session cookies, and generic `API_KEY`/`SECRET` assignments.

Does scanning a snippet save it to the database?

No. Scanning and redacting run ephemerally in memory without persisting anything to the database. A note is only created if you explicitly click "Share Clean Link".

What happens when I click "Apply Redaction"?

Every detected secret in the editor is replaced with a type-specific placeholder such as `[REDACTED_AWS_KEY]`, `[REDACTED_JWT]`, or `postgres://[REDACTED_CREDENTIALS]@...` so you can review and share safely.

Explore Related Tools, Templates & Comparisons

Security & Auth Templates → · Supanote vs PrivateBin →
Logs & SRE
Nginx Log Analyzer

Parse Nginx combined access logs and upstream error traces instantly with HTTP status colorizing and secret scanning.
Containers
Docker Log Viewer

Inspect Docker Compose stdout/stderr streams, JSON log drivers, ANSI color codes, and multi-line stack traces.
Data Grid
CSV & TSV Viewer

Turn raw comma, tab, or semicolon-delimited text into a fast, sortable spreadsheet table in one paste.
Artifact View
HTML Sandbox

Preview self-contained HTML, CSS, and JavaScript snippets live and share them as Claude-style `/v/:id` artifacts.
Notification