11 values hidden in error-report.txt
The safe text is ready to paste. Read it once before you share it.
Safe to paste
What was found
- Password in a URL
DATABASE_URL Tr0u…026 · line 2[PASSWORD_1] - OpenAI-style API key
OPENAI_API_KEY sk-p…XYZ · line 3[API_KEY_1] - AWS access key ID
AWS_ACCESS_KEY_ID AKIA…PLE · line 4[AWS_ACCESS_KEY_1] - AWS secret access key
AWS_SECRET_ACCESS_KEY wJal…KEY · line 5[AWS_SECRET_1] - Stripe secret key
STRIPE_SECRET_KEY sk_t…7dc · line 6[STRIPE_KEY_1] - Email address
asha…com · line 8[EMAIL_1] - IP address
203.….42 · line 8[IP_1] - Card number
4111…111 · line 9[CARD_NUMBER_1] - Phone numberlikely
+44 …958 · line 9[PHONE_1] - JWT
eyJ0…8G0 · line 10[JWT_1] - IP address
198.…0.7 · line 12[IP_2]
Put your values back
Paste the model's answer. Every placeholder from the text above turns back into the value it stood for, with or without its brackets.
How this one works
Config is read the way a reviewer reads it: every key and its value, in PHP (including wp-config.php), .env, YAML, JSON, INI, XML, command-line flags and connection strings. A key that names a secret (a password, secret, token or salt, or a key such as AUTH_KEY holding a random value) has its value hidden. A key that names something else (a user name, a host, an ID, a timeout) is left alone, and so are keys that are public by design, such as Stripe's pk_ keys, and placeholders such as null, ${DB_PASS} or "put your unique phrase here".
Outside config, each kind of secret has its own detector, which checks a format rather than guessing: key prefixes from over 30 providers (OpenAI, Anthropic, AWS, GitHub, Stripe, Google, Slack, Shopify, Twilio and more), private key blocks, JWTs that decode, passwords inside URLs and Authorization headers. Card numbers must pass the Luhn check and IBANs their checksum. A long random string with nothing to say what it is counts as likely, and likely matches can be switched off.
The same value always gets the same placeholder, so the model can still tell one customer from another. The mapping from placeholder to value stays in this tab's memory, which is what lets the answer be restored, and it is gone when you close the tab.
Questions
Which files does it understand?
wp-config.php and other PHP config, .env files, docker-compose and other YAML, JSON, INI and XML config, connection strings, shell commands with flags, logs and code. Paste the file or drop it on the text box, and download the safe copy under the same name with .safe added.
Does it use AI to find secrets?
No. A language model good enough for this would mean either sending your text to a server, the one thing this tool exists to avoid, or downloading gigabytes into your browser. It would also miss things in ways nobody can predict. Rules that read keys and check formats are fast, exact and the same every time, and you can see why each value was hidden.
Is this a guarantee that nothing sensitive is left?
No. It catches the formats it knows and flags likely ones, but a name, an address or a secret in a format it doesn't know will get through. Read the safe text before you paste it.
Why not just delete the secrets?
A model answers better when it can see that a value was there and which one it was. "[API_KEY_1] is used before it is set" is a useful answer; a gap is not. Placeholders also let you restore the answer.
Does it send my text anywhere?
No. The detectors are plain JavaScript running in this tab, and nothing is stored, so there is nothing to leak.
Can I keep one value as it is?
Yes. Each finding has a Keep button, and each kind of value can be switched off at the top. Kept values stay in the safe text unchanged.