EnvVars

EnvVars is a powerful Chrome extension that instantly detects environment variables and hardcoded secrets exposed in your frontend JavaScript bundles. Perfect for security audits, code reviews, and ensuring production builds don't leak sensitive information. Developed by GTM Enterprises LLC - Learn more at https://gtmenterprisesllc.com WHAT IT DETECTS Environment Variables: • React: REACT_APP_* variables • Vue 3: VITE_* variables • Svelte: VITE_* variables • Next.js: NEXT_PUBLIC_* variables • Angular: Environment object properties • Vite: VITE_* variables • Nuxt: NUXT_PUBLIC_* variables • Gatsby: GATSBY_* variables • Generic: NODE_ENV, PUBLIC_URL, BASE_URL Hardcoded Secrets (NEW in v3.0): • AWS Access Keys (AKIA...) • AWS Secret Keys (40-char base64) • Stripe API Keys (sk_live_, pk_test_, etc.) • Google API Keys (AIza...) • UUIDs (common in tokens) • Generic API Keys (32+ character alphanumeric) • Payment provider credentials (PayPal, Square, Twilio) KEY FEATURES Secret Detection: • Automatically identifies hardcoded credentials • Visual warning banner when secrets detected • Dedicated Secrets filter for quick review • Helps prevent accidental credential leaks Multi-Framework Support: • Supports 8+ popular frameworks • Detects both prefixed variables and minified code • Works with production and development builds • Handles webpack, Vite, and esbuild outputs Easy to Use: • Click extension icon on any webpage • Instantly see all detected variables • Filter by framework (React, Vue, Next.js, etc.) • Search functionality for quick lookup • Tab-based interface for organized navigation • Search across all page scripts in dedicated search tab • Copy individual values with one-click button • Copy all, export as JSON, or export as .env file Advanced Detection: • Scans inline and external JavaScript files • Parses minified and obfuscated code • Detects key-value pairs and object literals • Supports unquoted keys in minified output • Analyzes up to 10 external scripts per page Security & Privacy: • No data collection - All processing happens locally in your browser • No external requests - Extension only reads JavaScript from the current page • Open source - Full source code available on GitHub • Offline capable - Works without internet connection PERFECT FOR • Security researchers and penetration testers • DevOps engineers reviewing production builds • Frontend developers debugging configuration issues • Code reviewers checking for credential leaks • QA teams validating environment setups USER INTERFACE Clean, modern interface with: • Gradient header with extension icon and refresh button • Tab-based navigation (Variables + Script Search) • Searchable variable list • Framework-specific filter buttons (compact design) • Icon-based source indicators with hover tooltips • Dedicated script search tab to search all page scripts • Warning banners for detected secrets • Copy to clipboard functionality • Export to JSON or .env format for reports • Responsive design that fits your workflow RECENT UPDATES (v3.5.0) New in v3.5.0: • Minor stability improvements and bug fixes v3.4.0: • Tab-based navigation (Variables tab + Script Search tab) • Extension icon in header for better branding • Fixed false positive detection of generic properties (name, value, etc.) • Cleaner, more organized interface v3.3.0: • Individual copy buttons for each variable value • Export to .env format (KEY=value, one per line) • Full secret values displayed (no truncation) • Quick copy with visual feedback v3.2.0 - UI/UX Improvements: • Replaced source text with icons + popovers (cleaner, saves space) • Icons: external, inline/bundled, window, hardcoded • Script search feature across all page scripts • Compact button design v3.1.0 - Framework Support: • Full Vue 3, Svelte, Angular support • Fixed false positive NODE_ENV detection • Improved pattern matching for minified code v3.0.0 - Secret Detection: • Hardcoded secret detection (AWS, Stripe, Google, UUIDs) • Security warning banner • 21+ detection patterns Quality Assurance: • Comprehensive Playwright E2E test suite (9 passing tests) • Automated testing for all 8 frameworks • Docker-based testing infrastructure • Well-tested and production-ready USE CASES Security Audit: Navigate to your production site, click the extension, and instantly see all exposed environment variables and secrets. Perfect for pre-release security reviews. Development Debugging: Quickly check which environment variables made it into your build. Useful when debugging configuration issues or verifying build processes. Code Review: Validate that sensitive credentials are not hardcoded in frontend bundles. The Secrets filter highlights potential security issues. Compliance Check: Ensure your application meets security standards by verifying no API keys, tokens, or credentials are exposed in client-side code. REPORT ISSUES Found a bug or have a feature request? Report it on GitHub: https://github.com/GTM-Enterprises-LLC/chrome-extension-front-end-environment- variable-viewer/issues TIPS • Use the search box to quickly find specific variables • Click Secrets filter to review detected credentials • Export to JSON for documentation or reports • Check both development and production builds • Regular audits help catch accidental credential commits TECHNICAL DETAILS • Manifest Version: 3 (latest Chrome extension standard) • Permissions: activeTab, scripting, host_permissions • Detection Patterns: 21+ regex patterns for comprehensive coverage • Performance: Optimized to limit script scanning (max 10 files) • Size: Lightweight extension, minimal resource usage WHY ENVVARS? Unlike manual inspection of JavaScript files, EnvVars: …