Ensor

Introducing Ensor

Automated Secret Redaction for Your Codebase.

Ensor is a simple, easy-to-use tool designed to automatically redact and sanitise secrets from your codebase. Currently utilizing .env or env.json for secret mapping with future scope to support additional formats like yaml, toml and etc. Ensor bridges a critical gap in the modern developer security pipeline.

The Missing Link in Secret Management

The industry has practically perfected the art of detecting secrets with tools like Kingfisher, Gitleaks, and Trufflehog. We also have excellent mechanisms for managing secrets by strategies like GitOps(sops, ejson) or, password managers or cloud vaults like Infisical, Bitwarden secrets manager, vault.

However, There is still a massive gap between detecting a secret and mitigating it. Until now, redacting secrets from raw code has been a highly manual and boring job, that wastes thousands of dollars in developer time. Ensor is the missing link that automates secret redaction directly in your workflow.

The Problem: Readability Vs. Security

Consider the common workflow of syncing api request files (.bru or .yaml) to git. When a pre-commit hook flags a leaked API key, developers face a dilemma:

1. Encrypt the whole file (e.g., using SOPS + custom bash scripts), which destroys the primary purpose of storing the requests for later reference and easy readability.
2. Manually find and replace every secret, which is tedious and error prone and time wasting.

This problem is compounded by the rise of ai assistants, giving them access to a codebase with embedded secrets is somehow equivalent to leaking those secrets in the open.

How Ensor Works

Ensor saves precious developer time by handling secret redaction automatically. Currently ensor only works on uncommitted files,

Ensor is built on top of robust scanning back end (powered by Gitleaks/Betterleaks) to identify credentials seamlessly.

• Intelligent .env Mapping: If you have a .env file populated with valid KEY=VALUE pairs, Ensor will automatically find hard coded values in your codebase and intelligently replace them with their respective KEYs as references.
• Interactive Codebase Scanning: For large codebases, Ensor scans the directory and detects raw secrets. It will then either auto-suggest a randomized secret name (key) or prompt you to provide a custom SECRET_NAME or key to replace the hard coded string.

Install now

go install github.com/pratyay360/ensor@latest

mise use github:Pratyay360/ensor@latest

or

mise use go:github.com/Pratyay360/ensor@latest

curl -sSL https://raw.githubusercontent.com/Pratyay360/ensor/main/install.sh | sh

ensor redaction (example)

ensor convert

ensor can convert between any format of env files. dotenv, YAML, TOML, JSON interchangeably.

By automating redaction, Ensor keeps your codebase clean, your secrets stays secure in your environment file i.e. .env.