Why score your .env leak risk?
.env files hold sensitive data — API keys, database passwords, tokens — yet they're one of the easiest things to mismanage. They get committed to git by accident, shared over Slack, or stored in plaintext inside CI/CD configs. This calculator scores your team's .env habits across six checks to gauge how exposed you really are.
The 100-point scale weighs git commit history (25 points) and a missing .gitignore entry (20 points) the heaviest. If a secret ever touched git history, rebasing or deleting commits won't undo the exposure — the only safe fix is rotating the key itself. Sharing secrets over Slack or email (20 points) carries similar weight because those logs persist indefinitely.
If your score tops 40, it's time to consider a dedicated secret manager like Vault, AWS Secrets Manager, or Doppler, and set up a regular rotation policy. Re-running this checklist every six months helps track whether your team's security habits are actually improving.
Frequently Asked Questions
No. Deleting commits or rebasing doesn't invalidate a key that already leaked. You must rotate the exposed credential regardless of history cleanup.
This score only reflects common .env-related risks. Even at 0, you should still review other security layers like firewalls and access control separately.
Team size doesn't reduce the damage from a leaked key. Many secret managers offer free tiers, so the barrier to adoption is low.