Sensitive values
--
Developer Security & Safe Sharing
cURL Command Secret Scanner and Sanitizer
Inspect a cURL command locally before sharing it. Mask credentials, preview redactions, and generate a safe support example without executing the request.
Local inspection workspace
Awaiting cURL command
Paste a cURL command to inspect headers, query parameters, cookies and request data before sharing it.
High-risk findings
--
Headers inspected
--
Query parameters
--
Body fields inspected
--
Command structure map
Exposure profile
No command has been analysed. Results remain local to this browser.
Why cURL commands can expose secrets
Authorization headers can contain reusable credentials, cookies can expose authenticated sessions, and copied browser commands may include identifying headers. Query strings and request bodies can also carry tokens, passwords or personal data.
What the inspector checks
The local rules inspect common headers, authentication schemes, query parameter names, safely parseable JSON and form fields, internal hosts, local paths and common browser noise. Findings are evidence for review, not a guarantee that every secret was found.
How cURL sanitisation works
The command is tokenised locally without evaluating variables, substitutions, files or commands. Recognised values are masked in the dashboard, then selected rules replace, remove or convert values in a visible preview.
Safe-share, minimal and environment-variable outputs
Safe-share output preserves useful request structure with placeholders. Minimal output can remove selected browser noise. Environment output uses placeholders such as ${API_TOKEN} and includes an empty .env.example template.
Sensitive data that requires manual review
Look carefully for account identifiers, uncommon token formats, signed URL values, proprietary headers, opaque body fields and target infrastructure that pattern rules cannot confidently classify.
Why local browser processing matters
A support command can contain live access. This tool has no API, route handler, analytics payload, browser storage, clipboard reading or command execution. Copy actions write only outputs you request.
Frequently asked questions
How do I safely share a cURL command?
Inspect the command, review the masked findings, keep the redactions you need, then review the generated safe-share command before copying it.
Can a cURL command contain passwords or API keys?
Yes. Authorization headers, cookies, query strings and request bodies can contain reusable credentials or passwords.
Does MicroIntent send or execute my cURL command?
No. Inspection and report generation run locally in your browser. The tool does not execute, transmit or store the command.
How does the tool redact an Authorization header?
Recognised Authorization values are shown as masked evidence and can be replaced with [REDACTED] or an environment-variable placeholder.
Can it remove cookies from a cURL command?
Yes. Recognised Cookie and Set-Cookie values can be removed from the safe-share and minimal previews.
What is a bearer token?
A bearer token is a credential that can authorize a request for whoever possesses it, so it should not normally be shared in a support example.
Can it convert secrets into environment variables?
Yes. Selected credentials can become deterministic placeholders such as ${API_TOKEN}, with a separate empty environment template.
What is removed from a minimal cURL command?
Selected browser noise headers can be removed while method, URL structure, meaningful headers and request data remain visible for review.
Does sanitising a cURL command guarantee it is safe?
No. Pattern-based detection cannot identify every secret or identifying value. Review every generated command before sharing.
Which cURL formats are supported?
The local parser supports common Bash and zsh commands, backslash continuations, Chrome and Firefox Copy as cURL commands, and common Postman output. It does not evaluate shell syntax.
Related local security tools
Use these tools for adjacent review tasks before sharing developer evidence.