Env Clinic – find leaked secrets without uploading them.
AI-assisted coding has produced a wave of projects with API keys sitting in plain text. Classic secret scanners want the code uploaded to the cloud – which is exactly the problem. Env Clinic scans a project locally: no network, no telemetry, and every finding is shown redacted, so secrets never leave the device. We developed the scanner and its product site.
- Security
- CLI
- Open source
- For vibe coders
What we built
Security tooling for beginners, not just DevOps
Env Clinic is written for people who ship fast with AI tools – every finding comes with a plain-language explanation and clear fix steps.
Finds real risks
Detects API keys, tokens and credentials in source files, spots risky .env handling and missing protection rules like .gitignore entries.
100% local
The scanner makes no network calls at all – it works offline. No code, no secrets and no metadata ever leave the machine.
Launch Score
One number from 0 to 100 tells the user whether a project is safe to publish – with a clear «Do not launch» verdict when criticals are open.
Git-history scan
Optionally digs through the git history, because a key deleted yesterday is still in every old commit.
How the tool works
From install to verdict in three steps
Install
Via npm or as a standalone binary for Windows, macOS and Linux – no Node.js installation required.
Scan
One command in the project folder. The scanner walks the files locally and redacts everything it reports.
Fix & launch
Each finding comes with concrete fix steps. Re-run until the Launch Score gives the green light.
Under the hood
Open source core, product polish
The scanning core is open source (MIT) on GitHub – anyone can verify that no data leaves the device. The CLI is written in TypeScript/Node.js and compiled into per-platform standalone binaries.
The product site is four-language (DE/EN/FR/IT) and deliberately written for beginners: no enterprise security jargon, every term explained.
Env Clinic shows the same delivery pipeline we apply to web SaaS – product, documentation, site and distribution – applied to a developer tool. We developed it; our client publishes and supports it.
See it live
Scan before you ship.
Have a look at the finished product and its terminal demo to see how the local scan works.