slancio

What to rotate after a breach, in what order.

npx slancio            # scan the current project
npx slancio ./my-app --platform Railway

Scans your source code (process.env, os.getenv, ENV[], zod env schemas, GitHub Actions secrets, Docker Compose…) and .env files for the secrets your project uses, then prints a prioritized rotation checklist with direct revoke links for 60+ providers.

Nothing leaves your machine. The CLI makes no network requests and never prints secret values.

Options

| Flag | | |---|---| | --platform <name> | Label the checklist with the breached platform | | --markdown | Markdown checklist for an issue or incident doc | | --json | Machine-readable output | | --csv | Rotation evidence CSV | | --fail-on-exposed | Exit 1 if a secret uses a public prefix (NEXT_PUBLIC_, VITE_, …) — use in CI |

In CI

- run: npx slancio --fail-on-exposed

Web version, provider guides and breach alerts: https://slancio.io