ServerSecretVault (ssv) finds .env, wp-config.php, Magento, Joomla and Drupal config files across every hosting account, flags world-readable files and backup copies inside web roots, and makes an age-encrypted backup. It never prints a secret.
Automatically discover .env, WordPress, Laravel, Magento, Joomla and other credential-bearing configuration files.
How ssv scan works →/home ├── acme/public_html │ ├── wp-config.php WordPress │ └── wp-config.php.bak backup ├── shop/app/etc/env.php Magento ├── portal/configuration.php Joomla └── api/.env.production Laravel
Flag world-readable and group-writable files, forgotten backup copies, and secrets stored inside web roots, where they may be downloadable.
Severity rules →Each file gets the highest severity any rule gives it: permissions, backup-like names and web-root location.
Securely archive important configuration files without creating plaintext temporary backups.
Encrypted backups with age →No plaintext archive is written to disk.
Yellow marks backup copies, the most dangerous files ssv finds: a web server runs wp-config.php as code, but sends wp-config.php.bak to anyone who asks for it, as plain text.
ssv won't find every secret on a server. Credentials in databases, environment variables or other files are out of scope. Full list of detected files →
Searches /home, /var/www and /srv/www, where cPanel, Plesk, DirectAdmin and CloudPanel keep their sites, and recognises public_html, httpdocs and htdocs web roots. Use --root to search somewhere else.
Every file gets its owner, permissions, size, modification date, SHA-256 hash, web-root status and a severity: SECURE, REVIEW, HIGH or CRITICAL. Secret values are never displayed.
Encrypt every file into one archive with age public keys (recommended, and works from cron), SSH keys or a passphrase. Files stream straight into age, so no plaintext archive is written. Needs the age tool installed.
Every file gets the highest severity any rule gives it, with the reasons listed. ssv only reports; the fixes are yours to choose.
.env file is inside a web root"Inside a web root" means the file may be downloadable, not that it is. Confirm with curl -sI https://example.com/.env: you want 403 or 404, not 200. Severity rules and typical fixes →
--fail-on high exits with status 3 when any file is HIGH or worse.--json output for jq, dashboards and tickets.Backups use the open age format. Even if ServerSecretVault disappeared, you can still decrypt them with standard tools.
How ssv handles your secrets →find / -name ".env"?Audit every hosting account's web root in one run with sudo.
Find wp-config.php backups left behind by migrations and editors.
A read-only inventory with checksums that never prints a secret.
List every credential file to rotate, as JSON for your notes.
Fail a nightly check when anything is HIGH or worse.
Check that no .env file or template sits inside a web root.
No. ServerSecretVault doesn't store, serve or rotate secrets. It finds the configuration files on a server that already hold them, rates their risk and makes encrypted backups. That inventory is a useful first step before moving secrets into a secrets manager.
It reads file contents only to compute SHA-256 checksums and to make backups. It never prints secret values and never makes network requests, so nothing leaves the server. See how ssv handles your secrets.
No. ssv only reports. Each finding lists its reasons, and the audit docs give the typical fix for each severity.
A file counts as inside a web root when it is in a directory named public_html, httpdocs, htdocs, webroot, www, web or public, which includes everything under /var/www and /srv/www. That means it may be downloadable, not that it is: ssv makes no network requests, so confirm with curl -sI https://example.com/.env and look for 403 or 404.
Only to see other accounts' files. Without root, ssv sees the files your own account can read. Run it with sudo to cover every hosting account.
ssv backup needs the age encryption tool (apt install age or dnf install age). Restoring needs only age and tar, not ssv. See restoring from a backup.
Any Linux server with an x86_64 or ARM64 processor, including Ubuntu, Debian, RHEL, Rocky Linux, AlmaLinux and CloudLinux. ssv is a single self-contained program with no runtime or libraries to install.
Yes. ssv audit --fail-on high exits with status 3 when any file is HIGH or worse, and --json gives machine-readable output. See running ssv on a schedule.
The installer checks each package against its SHA-256 checksum and stops if they don't match. To check by hand, download SHA256SUMS next to the package and run sha256sum -c --ignore-missing SHA256SUMS. See the install guide.
Delete /usr/local/bin/ssv, and /usr/bin/ssv if the installer created that link. ssv creates no configuration files, services or caches.
ssv is proprietary software. Downloading or installing it means accepting its license.
Backups also need age. If it's missing, ssv backup prints the commands that install it on your server. How to install age