Report Bug · Request Feature

Table of Contents

1. About The Project
   • [!] Disclaimer
   • Built With
2. Getting Started
   • Installation
   • GitHub Cookies
3. Usage
4. Contributing

About The Project

In the world of software development, API keys and other sensitive credentials are the keys to accessing critical services and applications. Unfortunately, these keys are sometimes accidentally exposed in public repositories, putting both developers and organizations at risk. If left unprotected, malicious actors can exploit these exposed credentials to access and misuse valuable data, leading to breaches, financial losses, and damaged reputations.

SaveEnv was created to address this growing problem by automating the process of detecting and notifying developers about exposed OpenAI API keys in .env files. By monitoring public GitHub repositories, SaveEnv helps prevent sensitive data from falling into the wrong hands. The project's aim is to provide an easy-to-use tool that alerts developers to their mistakes before they can be exploited.

SaveEnv is a command-line tool. Here’s how a scan works:

1. It searches public GitHub repositories for .env files that may contain OpenAI API keys.
2. It extracts the candidate keys from those files.
3. For each extracted key, it calls the OpenAI API to verify whether the key is still valid.
4. If the key is valid, it opens an issue on the affected repository to notify the developer about the exposed key.

Statistics from each run (keys checked, compromised keys, last scan time) are stored locally and can be printed at any time with python run.py stats.

🛑 Disclaimer 🛑

This tool is designed to help developers protect their sensitive data. It is not intended for malicious use. By using this script, you agree to use it responsibly and within ethical boundaries. Always respect data privacy and security best practices.

Built With

• 
• 
• 

(back to top)

Getting Started

Installation

1. Clone the repository:

   git clone https://github.com/cprite/save-env.git
   cd save-env

2. (Optional) create a virtual environment:

   python -m venv venv
   source venv/bin/activate

3. Install the dependencies:

   pip install -r requirements.txt

   Google Chrome must be installed — Selenium drives it in headless mode. The matching ChromeDriver is downloaded automatically on first run.

GitHub Cookies

GitHub code search requires an authenticated session. Copy the example file and fill in the cookies from a logged-in GitHub session in your browser (DevTools → Application → Cookies):

cp app/crawler/data/cookies.example.py app/crawler/data/cookies.py

cookies.py is git-ignored — never commit your real session cookies.

(back to top)

Usage

Run a single scan and print the results:

python run.py scan

Keep scanning on a schedule (e.g. every hour) until interrupted with Ctrl+C:

python run.py scan --interval 3600

Print the statistics from the last scan without scanning again:

python run.py stats

Add -v / --verbose to any command for debug logging:

python run.py -v scan

Full help:

python run.py --help
python run.py scan --help

(back to top)

Contributing

I'm open to collaboration and contributions from fellow developers! You can easily adapt the code to work with other APIs beyond OpenAI. Feel free to fork the project and modify it to suit your needs. Together, we can enhance this tool and help more developers safeguard their projects.

(back to top)