Skip to main content
If you’re an owner or administrator of a 1Password Business account, learn more about the developer secrets discovery report.
1Password Developer Watchtower can check for developer secrets stored on your local disk, such as SSH keys that are unencrypted or that use outdated cryptography, and .env files that contain plaintext variables. Developer Watchtower will alert you about secrets that don’t follow best practices, so you can mitigate secrets risk and improve the security of your workflow. 1Password only looks for developer secrets in defined locations on your local disk. Secret values are never collected or revealed, and no one at 1Password can see or access your data.

Requirements

Before you can use Developer Watchtower, you’ll need to:

Step 1: Turn on local disk scanning

  1. In the 1Password desktop app, select Developer in the sidebar, then select View Watchtower.
  2. Choose the types of secrets you want 1Password to check for:
    • Select SSH keys to scan your ~/.ssh directory for insecure and unencrypted SSH keys.
    • Select .env files to scan your local disk for .env files that contain plaintext secrets.
Then view your results in Developer Watchtower. Local disk scanning doesn’t collect or reveal secret values. Learn more about local disk scanning for SSH keys and .env files in Developer Watchtower.
If you use 1Password as part of an organization, local disk scanning may be controlled by an account policy.You can go to Settings > Developer > Watchtower to check if there’s a message that local disk scanning is managed by your organization. Contact your administrator to learn more.

Step 2: View your results and remediate issues

After local disk scanning is turned on, Developer Watchtower will list any SSH keys and .env files found on disk, according to your settings. Then you can remediate any issues.

Take action on SSH key alerts

SSH key alerts are listed according to the attributes with the highest security impact. To act on an alert:
  1. Select an SSH key item in the list to see more information about the issue.
  2. Select the down arrow to the right of the item to see a list of available actions.
  3. Remediate issues based on the type of alert for each key.
Use the following table for more information about SSH key alerts and remediation: Learn more about how SSH key scanning works.

Import plaintext secrets from local .env files

Developer Watchtower only supports importing and mounting local .env files on Mac and Linux at this time. Windows support is coming soon.
Developer Watchtower will alert you about any .env files it finds on disk that contain plaintext secrets. You can then import those secrets into new or existing 1Password Environments and choose if you want to mount your .env files. Use the following steps to import plaintext secrets from local .env files into 1Password:
  1. In the 1Password desktop app, select Developer in the sidebar, then select View Watchtower.
  2. Select an item in the list to see more information about the project secrets and variables in the .env file.
  3. Select Import on an item to import the secrets into 1Password.
  4. Choose if you want to import your environment secrets into a new or existing environment and if you want to mount the file:
    1. Select New environment to create a new 1Password Environment. Enter a name for the environment and select the 1Password account you want to save the environment in.
    2. Select Existing environment if you already have a 1Password Environment you want to import the secrets into. Choose your environment from the list.
    To mount the environment file, make sure Mount .env file at is selected.
  5. Select Import environment.
1Password will create a new environment, or update an existing one, with the variables from your .env file. If you also mounted the environment file, 1Password will replace the plaintext .env file on disk with a locally mounted .env file at the same path. Learn more about how .env file scanning works.

About SSH key scanning

If you use 1Password as part of an organization that has a local disk scanning policy enabled, some metadata for unencrypted SSH private keys may be included in a developer secrets discovery report.The report is only available to people in the Owners and Security groups of the account. Secret values are never collected or revealed.
Developer Watchtower scans your $HOME directory for SSH keys in the following location and formats: 1Password doesn’t follow symlinks or traverse file systems (for example, an external drive mounted at ~/.ssh/other will be skipped). Files over 1 MiB (mebibyte) in size are also skipped. If any SSH keys are found within these parameters, they’ll be added to Developer Watchtower to alert you to security issues and provide recommendations to improve your SSH key management.

Ignore files

If you want 1Password to ignore specific files when checking for developer secrets, you can create a .ignore file in your SSH folder. Then add entries to the ~/.ssh/.ignore file to specify which files 1Password should ignore. For example:
Example entries in ~/.ssh/.ignore file

SSH key alerts

Insecure key type

An insecure SSH key is a critical security issue that needs to be addressed. Insecure keys are vulnerable to being cracked, which can provide attackers with the ability to infiltrate and compromise servers. Insecure keys include:
  • DSA keys
  • RSA keys less than 2048 bits in strength
OpenSSH is removing support for these insecure key types, along with major developer platforms like GitHub and GitLab. If Developer Watchtower alerts you to an insecure SSH key, it’s imperative that you remove the SSH key file from your disk and from the authorized_keys file of every server it’s used with. First, remove the insecure key from the authorized_keys file of every server, or from any service, where it’s used. Next, generate a new, secure SSH key in 1Password and use the new key to replace the insecure key anywhere it was used. Then, in Developer Watchtower, select the action menu for the insecure key and choose Delete SSH key from disk to permanently remove the key from disk.

Unencrypted key

A private key file stored in plaintext is a security vulnerability and provides an easy target for malware. Encrypting your SSH private keys with passphrases provides another layer of protection and is a common practice supported by SSH clients. If Developer Watchtower alerts you to an unencrypted key on your local disk, you can choose one of the following options from the action menu:
  • Import: When you import an SSH key into 1Password, it’s automatically encrypted for you. After you import the key into 1Password, you can permanently remove the redundant copy from your disk. Select the action menu for the unencrypted key in Developer Watchtower and choose Delete SSH key from disk.
  • Copy Encryption Command: If you prefer to keep a copy on disk, you should encrypt the key file with a passphrase. This option copies the ssh-keygen command to your clipboard, including the path to your key. You can run the command in your terminal app:
    The -pf flag prompts you to create a passphrase and specify the private key file you want to encrypt.

Import into 1Password

Storing your SSH keys in 1Password allows you to securely authenticate all your Git and SSH commands from 1Password using the 1Password SSH Agent. Your private keys never leave 1Password, are never stored locally, and are never used without your consent. Learn more about 1Password SSH Agent security. If Developer Watchtower detects an SSH key that is both encrypted and a supported key type, you can import the key into 1Password. Select the down arrow on the right of the item, then select Import. After you import the SSH key, you can remove the redundant copy of the key from your local disk.

Already exists in 1Password

1Password compares the public fingerprint of the SSH key on your local disk with the fingerprints of your SSH Key items in 1Password to determine if you’ve already saved the key there. If Developer Watchtower indicates that a key in your local ~/.ssh folder has already been saved 1Password, you can remove the redundant copy of the SSH key on disk. Select the item’s action menu and choose Delete SSH key from disk to permanently remove the key from disk.

Unsupported key

An SSH key that isn’t supported in 1Password can’t be imported. Check the list of supported SSH key types for more information. If Developer Watchtower lets you know that a key on your local disk is unsupported, consider generating a new SSH key if you want to use it with the 1Password SSH Agent. You may also be able to convert some keys to a format 1Password does support. For example, 1Password doesn’t support keys in the PuTTY format (.ppk), but PuTTYgen lets you export your PPK keys into the OpenSSH format, which is supported.

About .env file scanning

If you use 1Password as part of an organization that has a local disk scanning policy enabled, some metadata for .env files containing plaintext secrets may be included in a developer secrets discovery report.The report is only available to people in the Owners and Security groups of the account. Secret values are never collected or revealed.
Developer Watchtower scans your $HOME directory for .env files that contain plaintext secrets in the following locations:
  • ~/code
  • ~/dev
  • ~/Developer
  • ~/git
  • ~/projects
  • ~/Projects
  • ~/repos
  • ~/src
  • ~/work
It also checks for any variant matching the ^\.env(\..+)?$ pattern, such as .env, .env.local, or .env.production. 1Password only provides alerts for .env files that contain values likely to be sensitive, like API keys or tokens. The following files aren’t surfaced:
  • Files that contain only non-sensitive values, such as NODE_ENV=development.
  • Files whose values are already managed by 1Password.

Learn more