Key Audit

Key Audit finds potentially unsafe storage of API keys and other secrets in Drupal configuration and local files, with practical recommendations for improving how they are stored.

Features

• Scan active Drupal configuration, exported settings, and local files.
• Check Configuration, Environment, File, and State providers, with extensible checks for additional Key providers.
• Get severity ratings and suggested actions without exposing matched secret values in reports.
• Use Drush or a standalone scanner, with JSON output and configurable thresholds for automated checks.
• Optionally enable Key Audit Fix to preview and apply migrations from configuration storage to protected files.

Useful for security reviews, deployment checks, and preparing configuration for version control. Ordinary scans are read-only; findings require human review.

Post-Installation

Enable Key Audit, then run this command from your project root:

vendor/bin/drush key-audit:config --project-root="$PWD"

Review the findings and follow the suggested actions. There is currently no administration page. See the README for file scanning, multisite options, and optional remediation.

Additional Requirements

Requires Drupal 10.3 or later in the 10.x series, or Drupal 11, and Key 1.22 or later in the 1.x series: https://www.drupal.org/project/key.

Drupal commands require Drush 12.5–12.x or 13.x. The standalone scanner does not require Drush. Optional file migration requires PHP's POSIX extension and suitable persistent private storage.

Recommended modules/libraries

Key Status tracks exposure assessments and remediation history: https://www.drupal.org/project/key_status.

Similar projects

Security Review checks broader Drupal security settings. Key Audit focuses on secret storage and Key-provider configuration: https://www.drupal.org/project/security_review.

Supporting this Module

Contribute testing, documentation, bug reports, or provider integrations. Use invented credentials in examples; never post real secrets.

Community Documentation

The included README and documentation cover commands, reporting, integrations, and remediation. Key Audit Fix includes a separate migration and recovery guide.