Find Plaintext Secrets Hiding in Your .env Files

This is a companion to my earlier post, A Small Hardening Trick for .env.local : dotenvx + OS Keychain , where I described a pattern for encrypting local secrets with dotenvx and storing the decryption key in the OS keychain. That post was about fixing the problem. This one is about finding it first. The problem with "just gitignore it" If you have been developing locally for a while, you probably have .env files scattered across dozens of project directories. Some are recent, some are from projects you have not touched in months. Some contain harmless config. Some contain database URLs, API keys, and auth secrets in plaintext. The trouble is that you do not always know which is which, especially once you have 10 or 20 repos checked out under ~/code . And if a supply chain attack or a compromised tool scans your filesystem, it does not care whether you remember what is in those files. I wanted a quick way to answer one question: where on my machine are plaintext secrets sitting in .env