FAQ

EnvLens — paste a .env, YAML, or TOML config and get findings for leaked secrets, insecure settings, and a remediation checklist mapped to common weakness types.

What does EnvLens do?

You paste configuration text. EnvLens flags likely API keys, tokens, passwords, private keys, and insecure settings (for example debug flags or open CORS), then suggests rotation and hardening steps.

Is this a penetration test or certification?

No. EnvLens is decision-support for configuration review. It is not a penetration-test certification, not a substitute for a scoped security assessment, and not legal advice.

Do you guarantee 100% detection?

No. Pattern and context scanning can miss novel formats, obfuscated values, or secrets outside the pasted text. EnvLens does not guarantee 100% detection or that you will never miss a leak. Always rotate confirmed exposures and review with a human.

What standards do you reference?

We align findings with guidance such as the OWASP Secrets Management Cheat Sheet and CWE-798 (Use of Hard-coded Credentials) as industry references — not as a formal certification seal.

What happens if AI is unavailable?

Fail-closed: explicit Demo mode is labeled; missing configuration returns 503; upstream failures return 502; quota returns 429. Never silent mock as live AI.

How does pricing work?

$29/month or $290/year via /api/checkout with monthly or yearly cycle. Enterprise can include BYOK/DPA. Annual UI shows monthly-equivalent price plus savings.

Policies & contact

Privacy · Terms · lixingliangsy@163.com