Prevent API keys, tokens, secrets, and .env files from accidentally reaching Git repositories.
APIKey Guard is a security-focused VS Code extension that scans your code in real time, detects exposed credentials, and blocks unsafe commits before they become security incidents.
Detect Early. Fix Fast. Commit Safely.
Why APIKey Guard?
Leaked API keys and secrets are one of the most common causes of security incidents in modern development.
Whether you're building with AI tools, working on side projects, or shipping production software, accidentally committing credentials can lead to:
- Unexpected cloud bills
- Unauthorized API usage
- Account compromise
- Data exposure
- Production security risks
APIKey Guard helps prevent these mistakes before they reach Git.
Features
Real-Time Secret Detection
Instantly detects exposed credentials while you code, including:
- OpenAI API Keys
- AWS Access Keys
- GitHub Tokens
- Stripe Secret Keys
- MongoDB Connection Strings
- Firebase & Google API Keys
- SendGrid Keys
- Slack Tokens
- Discord Bot Tokens
- JWT Tokens
- High-Entropy Secrets
Commit Protection
Automatically installs a Git pre-commit hook and blocks commits containing sensitive credentials.
No accidental pushes. No exposed secrets. No surprises.
📁 .env File Protection
Detects .env, .env.local, and other environment files that are not properly ignored.
Get warned before sensitive configuration files are committed.
Smart File Scanning
Scans source code and text-based files while safely ignoring binary files such as:
- Images
- Videos
- Archives
- Executables
This reduces false positives while maintaining strong security coverage.
🛠 Quick Fix Actions
Move detected secrets into environment variables with one-click fixes.
Reduce manual work and follow security best practices faster.
😈 Roast Modes
Security doesn't have to be boring.
Choose your preferred warning style:
- Chill
- Aggressive
- Toxic
From friendly reminders to brutal reality checks.
Example Warning
------- APIKey Guard Alert -------
Detected exposed secrets in app.js:
• OpenAI API Key
• MongoDB URI
Move sensitive values to environment variables
before committing your code.
Commit Block Example
Commit blocked by APIKey Guard
Sensitive credentials detected in staged files.
Please remove the exposed secrets or move them
to a secure environment file before committing.
Supported Secret Types
- OpenAI API Keys
- AWS Access Keys
- MongoDB URIs
- Stripe Secrets
- GitHub Tokens
- Firebase Keys
- Google API Keys
- Slack Tokens
- Discord Tokens
- Cloudinary URLs
- SendGrid Keys
- JWT Tokens
- Generic High-Entropy Secrets
📦 Getting Started
- Install APIKey Guard from the VS Code Marketplace.
- Open a Git-enabled workspace.
- APIKey Guard automatically enables commit protection.
- Start coding normally.
- If sensitive information is detected, you'll receive immediate warnings and protection.
🛡️ Security Philosophy
APIKey Guard follows a simple rule:
Secrets should never be committed to version control.
Catch mistakes early. Fix them quickly. Ship code safely.
Author
Created and maintained by SAHIL KUMAR.
If APIKey Guard helps you avoid a secret leak, consider leaving a review and sharing feedback.
License
MIT License