Get started with EnvLens in minutes

---

What you need

EnvLens is web-first. You don't install anything to get your first scan. You need two inputs: a config snippet (.env / yaml / toml) and a scope — Secrets only, Insecure settings, or Both. No API key is required for the demo path; the app runs in mock mode and returns a representative scan you can review immediately.

Three steps

Paste the config — Drop in your .env, a values.yaml, or a pyproject.toml. Include the sections you're unsure about; the scanner checks credential-shaped values and insecure settings across the file.
Pick a scope — Secrets only (keys/tokens/passwords), Insecure settings (debug=true, wildcard CORS, disabled TLS), or Both.
Scan — EnvLens returns findings by severity (HIGH/MED/LOW), maps each to a weakness type (e.g., CWE-798), and lists a prioritized remediation checklist.

Reading your scan

The findings list is a view of exposure, not a verdict. HIGH means a live-looking credential — rotate it first. Each finding carries the weakness type so you know the right fix, not just the symptom. Export or copy the checklist into your tracker and assign owners.

What happens next

After the first scan, teams wire EnvLens into CI and add a pre-commit hook so the next commit is blocked before it leaks. EnvLens is the fastest path from "we're not sure what's in our config" to "here are the findings and the fixes" — it is not a penetration test and does not rotate or remediate for you.

Authoritative references

OWASP Secrets Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
CWE-798 (Hard-coded credentials): https://cwe.mitre.org/data/definitions/798.html

FAQ

Do I need an API key to try EnvLens?

No. The app runs in mock mode and returns a representative scan without a key. A key enables tailored scanning of your real config.

How long does the first scan take?

Minutes. Paste the config, pick a scope, scan. The output is findings by severity + weakness-type mapping + a remediation checklist you can export.

Is the scan a security certificate?

No. The scan is a view of exposure in the config you submitted — decision-support, not a penetration test, an audit, or a guarantee of a breach-free system.

What should I do with the findings?

Rotate any HIGH (live-looking) credential first, then assign owners to each finding via the checklist. EnvLens flags; your team remediates.

Is EnvLens a penetration test or guarantee?

No. EnvLens is a config scanner for exposed secrets and insecure settings. It is decision-support, not a penetration test, an audit, or a guarantee of a breach-free system.

## Disclaimer

Disclaimer (decision-support, not a security guarantee): EnvLens is a tool that helps teams find leaked secrets and insecure configuration in config files. It is not a penetration test, a security audit, or a guarantee that a system is secure or breach-free. Secret scanning reduces exposure but cannot cover every path; a clean scan is not proof of safety. Verify findings and remediate with qualified security engineers before relying on any result.

Paste your first config and get a secret + config scan in minutes — try EnvLens — try EnvLens.