Recommended Free Tools
How do I detect secrets in VS Code before they get committed? DotEnvy is a VS Code environment-file manager, and Aegis is its secret-scanning feature. Its documented design uses four stages—regex matching, a community blacklist lookup, an entropy gate and contextual neural classification—to screen candidate values. The project describes some checks as local and sends a narrower set of candidates for remote contextual analysis; that is not the same as keeping all source context on your computer.
What Aegis scans and how its pipeline is organized
DotEnvy’s project documentation describes Aegis as part of an environment-file manager for VS Code. The technical article by Kareem Ehab describes each candidate as a value paired with its context line and variable name. The four layers are a staged screening design: recognizable formats can be caught early, while later checks handle candidates that need additional evaluation.
As an Amazon Associate I earn from qualifying purchases.
The pipeline description appears in the technical article published September 24, 2026. The DotEnvy GitHub README and Open VSX change log provide project and release information. These are the author’s and project’s descriptions, not an independent verification of the implementation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What each of the four layers is designed to do
L1: Recognize familiar credential formats
The first layer applies deterministic regular expressions to patterns associated with recognizable token formats. The article gives AWS, Stripe, GitHub and Google credentials as examples. According to the author’s account, an L1 match is assigned high risk and skips the later analysis stages. This design can quickly flag strings that match known shapes; it does not establish how often real credentials are missed or harmless matches are raised.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
L2: Check a community blacklist
The second layer checks candidates against an in-memory community blacklist. The article’s design example builds a composite SHA-256-derived key using the variable name and the first eight characters of the value, then retains 16 hexadecimal characters of the digest. Treat those details as the author’s description of the design, not as an independently inspected implementation.
How do you cross-reference secrets without transmitting sensitive values over the network? A lookup based on a truncated hash is one approach described here, but it is not an anonymity guarantee. Hashing does not make an input impossible to guess: someone who can try likely variable names and value prefixes may be able to test candidate inputs. The article also describes community consensus for promoting blacklist entries and anti-poisoning measures. Their effectiveness in a live service has not been independently established.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
L3: Use entropy as a routing gate
The third layer calculates Shannon entropy and, in the author’s design, uses a threshold of 3.5 to decide whether a candidate proceeds to L4. The article characterizes values below that threshold as low risk and as not needing remote inference. This is a routing heuristic, not a definitive secret detector: entropy measures character unpredictability, not whether a string is a credential. Random-looking harmless data can score highly, while structured credentials can evade a simple statistical signal.
L4: Classify surviving candidates with context
Candidates that reach the fourth layer are sent to a contextual neural classifier, according to the technical article. The author describes a 35-feature vector incorporating string morphology, entropy and pattern signals, context words, identifier conventions, separators and derived interactions. The article says its experimental classifier uses Adam optimization and persisted model weights; the README separately describes a local fallback using 35 features. Those are project descriptions, not an independent assessment of the model’s quality or the exact behavior of every release.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Which checks are local, and what may be sent remotely
The project distinguishes the hash-based blacklist lookup from remote contextual classification. The README states: “DotEnvy does NOT upload your entire workspace.” It describes remote analysis as sending the suspected line and its immediate context. That is narrower than uploading a whole workspace, but it still means source context may leave the editor for candidates sent to L4.
The README also describes ephemeral processing and opt-in feedback training. These are project statements; the available sources do not independently establish server-side logs, retention settings, transport configuration or the live backend’s handling of submitted context. The article’s hash lookup and L4 analysis are distinct data flows: a truncated hash used for cross-referencing does not show that no contextual source text is transmitted for neural analysis.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The README says a shared secret is stored in VS Code SecretStorage, which uses OS credential storage, rather than embedded in the compiled extension bundle. The September 22, 2026 Open VSX release note for DotEnvy 2.1.0 also describes migration to OS-level SecretStorage. These storage claims are not a substitute for an independent security audit. The README lists VS Code 1.90.0 or later as a requirement.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the published numbers do—and do not—show
Kareem Ehab’s 2026 article reports that, in “typical codebases” workload benchmarks, approximately 20% of extracted candidates reach L4 and the remaining roughly 80% are resolved in memory. The article does not provide a benchmark corpus, measurement protocol or independent replication in the material available. The figure describes the author’s reported workload, not an 80% improvement in accuracy or security.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
The author also describes an experimental curated dataset containing 112+ labeled secret and non-secret samples. That is a dataset-size claim, not an accuracy result. The reported 3.5 entropy threshold is a design parameter, not an externally established standard.
No independent false-positive rate, false-negative rate, latency study or comparative benchmark is established in the cited materials. The published descriptions therefore explain the intended architecture, but do not show how reliably Aegis detects secrets across real projects or how it performs relative to other scanners.
What to consider before relying on Aegis
- Review the data flow: determine whether your files or context could reach L4, and whether sending that context fits your organization’s policies.
- Plan for uncertainty: regex patterns, blacklist matches and entropy thresholds are screening mechanisms; none alone proves a value is a secret or that an unmatched value is safe.
- Check operational dependencies: remote contextual analysis depends on the backend being available. The cited materials do not establish uptime or what behavior users should expect when that service is unavailable.
- Use it as a layer, not a guarantee: the available sources do not establish detection accuracy or provide a reproducible comparison with pre-commit or other scanning tools.
The Open VSX change log lists DotEnvy 2.1.0 on September 22, 2026, with the L1–L4 scanner and SecretStorage migration. Release notes confirm what the project says it shipped; they do not independently validate detection results, backend practices or security effectiveness.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
