Read-only means it does not write to your app. It does read every .env* file it finds at up to two levels of depth, gitignored or not — .env.local, .env.<anything>, and the .env.local.something-backup files people leave lying around.
The part that surprises everybody: the evidence snippet in the report is redacted for any file that is not .env.example, but the detected base URLs are not redacted at all. They go into the report, into the --report-only output, and into the generated envs/*.yaml. So the one field most likely to name an internal host is the field that comes through in clear.
There is an open issue. There is no opt-out flag today, so this is what to do meanwhile:
- before analyzing,
git status --ignored --short | grep '\.env' so you know what is in
scope
- always
--report-only first and read the envs block, not just the module list - if you have already applied, treat
projects/<slug>/envs/ as the thing to review before the
first commit, and rewrite any baseUrl you do not recognise
- if the app is not yours, analyze a shallow clone — a fresh clone has no local env files in
it at all, which sidesteps the whole thing
If a value has already been committed, rotate whatever it points at rather than just deleting the line. It is a URL rather than a credential, so this is usually about internal hosts leaking rather than access, but that judgement is yours to make and not mine.