Introducing ensor

Ensor: The Automated Secret Redaction for Your Codebase

Ensor is a lightweight, easy-to-use CLI tool designed to automatically sanitize hard coded secrets from your codebase. Currently mapping secrets via .env or env.json (with YAML and TOML support planned), Ensor bridges a critical gap in the modern developer security pipeline.

The Missing Link in Secret Management:

The industry has nearly perfected secret detection with tools like Gitleaks, Trufflehog and kingfisher. We also have excellent mechanisms for secret management, from GitOps strategies (SOPS, ejson) to cloud vaults (Infisical, Bitwarden secrets manager, HashiCorp Vault). However, Still remains a massive gap between detecting a secret and mitigating it. Until now, redacting secrets from raw code has been a tedious and manual task that wastes 1000s in developer time and productivity. Ensor is the missing link that automates redaction directly into your workflow.

The Problem: Readability vs. Security

Consider the common workflow of syncing API request files (.bru or .yaml) to Git. When a pre-commit hook flags a leaked API key, developers got 2 options:

Encrypt the entire file

Using tools like SOPS destroys the primary purpose of storing these requests—easy readability and quick reference.

Manually find and replace

Tedious, error-prone, and a waste of time.

The AI Factor

This risk is compounded by AI coding assistants. Feeding them a codebase with embedded secrets is equivalent to leaking those credentials in plain text.

How Ensor Works

Powered by a robust scanning backend (Gitleaks/Betterleaks), Ensor currently operates on uncommitted files to catch leaks before they happen:

Intelligent .env Mapping

If you have a .env file with valid KEY=VALUE pairs, Ensor automatically finds the hardcoded values in your codebase and replaces them with their respective KEY references.

Interactive Codebase Scanning

For broader scans, Ensor detects raw secrets and either auto-suggests a randomized key name or prompts you for a custom SECRET_NAME to replace the hardcoded string.

Convert between different formats of secret.

Use ensor convert to seamlessly translate environment files between dotenv, YAML, TOML, and JSON.

ensor repo

Installation

Using Go:

go install github.com/pratyay360/ensor@latest

Using Mise:

mise use github:Pratyay360/ensor@latest
# or
mise use go:github.com/Pratyay360/ensor@latest

Using cURL:

curl -sSL https://raw.githubusercontent.com/Pratyay360/ensor/main/install.sh | sh

A small video demo of the tool.

ensor demo 1

ensor demo of secret conversion

ensor can convert between any format of env files. Convert dotenv, YAML, TOML, JSON, etc interchangeably.

License: apache-2.0