{ let maskedLine = line; this.rules.forEach((rule) => { try { const re = new RegExp(rule.pattern, rule.flags); if (re.test(line)) { found.push({ line: idx + 1, label: rule.label, preview: line.slice(0, 64) }); maskedLine = maskedLine.replace(new RegExp(rule.pattern, rule.flags), '[REDACTED:' + rule.label + ']'); } } catch (err) {} }); outLines.push(maskedLine); }); this.findings = found; this.redacted = outLines.join('\n'); }, copyRedacted() { if (!this.redacted) return; navigator.clipboard.writeText(this.redacted); this.copied = true; setTimeout(() => this.copied = false, 1800); } }">

100% Client-Side • Zero Data Uploaded

Free .env & Source Code Secret Scanner

Runs WorkMA Sentinel's exact 7 production credential patterns locally inside your browser tab. Catch AWS keys, GitHub tokens, OpenAI keys, Slack tokens, private key blocks, and database passwords before pushing commits.

Paste .env, Config, or Git Diff

Detection Report

No known secret token patterns matched this snippet.

Sanitized Redacted Output

Automate This Check on Every Pull Request + Lock Keys in Vault

WorkMA Sentinel filters pull request diffs automatically while Encrypted Secrets Vault injects keys safely at runtime—free up to 5 users or $5/mo for 15 engineers.

Explore DLP IDE Empieza gratis

About Automated PR Secret Scanning

Does any secret or .env content leave my browser?

No. All 7 WorkMA Sentinel secret regex checks execute 100% client-side in your browser tab with zero network requests.

Which secret patterns are scanned?

AWS Access Keys (AKIA...), GitHub PATs (ghp_/github_pat_), Private Key PEM blocks, OpenAI keys (sk-...), Slack tokens (xox...), hardcoded credential assignments, and database URIs containing passwords.

How does WorkMA automate this across developer teams?

Inside WorkMA Code Nexus, Secrets Vault stores keys encrypted for runtime injection while Sentinel inspects pull requests automatically before merge.