> ## Documentation Index > Fetch the complete documentation index at: https://www.1password.dev/llms.txt > Use this file to discover all available pages before exploring further. # 1Password Developer Watchtower export const Image = ({src, darkSrc, alt, width, border, height, round}) => { const classNames = ["mint-mx-4"]; if (border) { classNames.push("mint-rounded-sm"); } if (round) { classNames.push("mint-rounded-lg"); } const style = {}; if (width) style.width = typeof width === "number" ? `${width}px` : width; if (height) style.height = typeof height === "number" ? `${height}px` : height; return darkSrc ? <> {alt} 0 ? style : undefined} /> {alt} 0 ? style : undefined} onError={e => { e.target.src = src; }} /> : {alt} 0 ? style : undefined} />; }; export const Small = ({children}) => { return {children}; }; If you're an owner or administrator of a 1Password Business account, learn more about the [developer secrets discovery report](https://support.1password.com/developer-secrets-report/). 1Password Developer Watchtower can check for developer secrets stored on your local disk, such as SSH keys that are unencrypted or that use outdated cryptography, and `.env` files that contain plaintext variables. Developer Watchtower will alert you about secrets that don't follow best practices, so you can mitigate secrets risk and improve the security of your workflow. 1Password only looks for developer secrets in defined locations on your local disk. Secret values are never collected or revealed, and no one at 1Password can see or access your data. Developer Watchtower showing several discovered insecure SSH keys and .env files with plaintext secrets. ## Requirements Before you can use Developer Watchtower, you'll need to: * [Sign up for 1Password.](https://1password.com/pricing/password-manager) * Install and sign in to 1Password for [Mac](https://1password.com/downloads/mac), [Windows](https://1password.com/downloads/windows), or [Linux](https://1password.com/downloads/linux).
Scanning for `.env` files is only available on Mac and Linux at this time. Windows support is coming soon. ## Step 1: Turn on local disk scanning 1. In the 1Password desktop app, select **Developer** in the sidebar, then select **View Watchtower**.
Or, navigate to **Settings** > [**Developer**](onepassword://settings/developers) and go to the Watchtower section. 2. Choose the types of secrets you want 1Password to check for: * Select **SSH keys** to scan your `~/.ssh` directory for insecure and unencrypted SSH keys. * Select **.env files** to scan your local disk for `.env` files that contain plaintext secrets.
Scanning for `.env` files is only available on Mac and Linux at this time. Windows support is coming soon. Then [view your results](#step-2-view-your-results-and-remediate-issues) in Developer Watchtower. Local disk scanning doesn't collect or reveal secret values. Learn more about local disk scanning for [SSH keys](#about-ssh-key-scanning) and [`.env` files](#about-env-file-scanning) in Developer Watchtower. If you use 1Password as part of an organization, local disk scanning may be controlled by an account policy. You can go to **Settings** > [**Developer**](onepassword://settings/developers) > **Watchtower** to check if there's a message that local disk scanning is managed by your organization. Contact your administrator to learn more. ## Step 2: View your results and remediate issues After local disk scanning is turned on, Developer Watchtower will list any [SSH keys](#take-action-on-ssh-key-alerts) and [`.env` files](#import-plaintext-secrets-from-local-env-files) found on disk, according to your settings. Then you can remediate any issues. ### Take action on SSH key alerts SSH key alerts are listed according to the attributes with the highest security impact. To act on an alert: 1. Select an SSH key item in the list to see more information about the issue. 2. Select the down arrow to the right of the item to see a list of available actions. 3. Remediate issues based on the type of alert for each key. Use the following table for more information about SSH key alerts and remediation: | Alert message | Description | Recommended Action | | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Insecure key type | An SSH key in an outdated format that's known to be vulnerable. | Remove the public key from the `authorized_keys` file of any server and service you've used it with. Then generate a new, secure SSH key in 1Password and delete the insecure key file from disk. [Learn more about insecure keys.](#insecure-key-type) | | This key is unencrypted | An SSH key stored in plaintext on disk. | Import the key into 1Password and remove the unencrypted copy from your disk, or use the `ssh-keygen` command to encrypt the file on disk. [Learn more about unencrypted keys.](#unencrypted-key) | | Import into 1Password | An SSH key that's encrypted and supported in 1Password but hasn't been imported yet. | Import the key into 1Password, then delete the redundant copy of your SSH key on disk. [Learn more about importing keys.](#import-into-1password) | | Already exists in 1Password | An SSH key you've already saved in 1Password. | Delete the redundant copy of your SSH key on disk and keep the key you've already secured in 1Password. [Learn more about duplicate keys.](#already-exists-in-1password) | | N/A (no message) | An SSH key that isn't supported in 1Password. | Generate a new SSH key in 1Password if you want to use it with the 1Password SSH Agent. [Learn more about unsupported keys.](#unsupported-key) | Learn more about [how SSH key scanning works](#about-ssh-key-scanning). ### Import plaintext secrets from local `.env` files This feature is being rolled out in stages and requires 1Password version 8.12.32 or later. If you don't see the option to import `.env` files with plaintext secrets in Developer Watchtower, you can [update to the latest version](https://support.1password.com/update-1password/) of the desktop app or [switch to the beta or nightly release channel](https://support.1password.com/betas/). Developer Watchtower only supports importing and mounting local `.env` files on Mac and Linux at this time. Windows support is coming soon. When you use Developer Watchtower to import an environment file, the original `.env` file is removed from your local disk to remediate the exposed secrets. Developer Watchtower will alert you about any `.env` files it finds on disk that contain plaintext secrets. You can then import those secrets into new or existing [1Password Environments](/environments) and choose if you want to [mount your `.env` files](/environments/local-env-file). Use the following steps to import plaintext secrets from local `.env` files into 1Password: 1. In the 1Password desktop app, select **Developer** in the sidebar, then select **View Watchtower**. 2. Select an item in the list to see more information about the project secrets and variables in the `.env` file. 3. Select **Import** on an item to import the secrets into 1Password. 4. Choose if you want to import your environment secrets into a new or existing environment and if you want to mount the file: 1. Select **New environment** to create a new 1Password Environment. Enter a name for the environment and select the 1Password account you want to save the environment in. 2. Select **Existing environment** if you already have a 1Password Environment you want to import the secrets into. Choose your environment from the list. To mount the environment file, make sure **Mount .env file at** is selected. 5. Select **Import environment**. 1Password will create or update an Environment with the variables from your `.env` file, then remove the original `.env` file from your local disk. If you also mounted the environment file, 1Password will replace it with a [locally mounted `.env` file](/environments/local-env-file) at the same path. Learn more about [how `.env` file scanning works](#about-env-file-scanning). ## About SSH key scanning If you use 1Password as part of an organization that has a local disk scanning policy enabled, some metadata for [unencrypted SSH private keys](#unencrypted-key) may be included in a [developer secrets discovery report](https://support.1password.com/developer-secrets-report/). The report is only available to people in the [Owners](https:/support.1password.com/groups/#owners) and [Security](https:/support.1password.com/groups/#security) groups of the account. Secret values are never collected or revealed. Developer Watchtower scans your `$HOME` directory for SSH keys in the following location and formats: | Location | Credential type | | ------------------------------------- | ----------------------------------------------------- | | `~/.ssh` (up to 3 nested directories) | SSH private keys in OpenSSH, PKCS#8, or PKCS#1 format | 1Password doesn't follow symlinks or traverse file systems (for example, an external drive mounted at `~/.ssh/other` will be skipped). Files over 1 MiB (mebibyte) in size are also skipped. If any SSH keys are found within these parameters, they'll be added to Developer Watchtower to alert you to security issues and provide recommendations to improve your SSH key management. ### Ignore files If you want 1Password to ignore specific files when checking for developer secrets, you can create a `.ignore` file in your SSH folder. Then add entries to the `~/.ssh/.ignore` file to specify which files 1Password should ignore. For example: ```text Example entries in ~/.ssh/.ignore file theme={null} test_key *_development ``` ### SSH key alerts

Insecure key type

An insecure SSH key is a critical security issue that needs to be addressed. Insecure keys are vulnerable to being cracked, which can provide attackers with the ability to infiltrate and compromise servers. Insecure keys include: * DSA keys * RSA keys less than 2048 bits in strength [OpenSSH ](https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-January/000156.html) is removing support for these insecure key types, along with major developer platforms like [GitHub ](https://github.blog/2021-09-01-improving-git-protocol-security-github/) and GitLab. If Developer Watchtower alerts you to an insecure SSH key, it's imperative that you remove the SSH key file from your disk *and* from the `authorized_keys` file of every server it's used with. First, remove the insecure key from the `authorized_keys` file of every server, or from any service, where it's used. Next, [generate a new, secure SSH key in 1Password](/ssh/manage-keys#generate-an-ssh-key) and use the new key to replace the insecure key anywhere it was used. Then, in Developer Watchtower, select the action menu for the insecure key and choose **Delete SSH key from disk** to permanently remove the key from disk.

Unencrypted key

A private key file stored in plaintext is a security vulnerability and provides [an easy target for malware. ](https://www.scmagazine.com/news/github-npm-registry-abused-to-host-ssh-key-stealing-malware) Encrypting your SSH private keys with passphrases provides another layer of protection and is a common practice supported by SSH clients. If Developer Watchtower alerts you to an unencrypted key on your local disk, you can choose one of the following options from the action menu: * **Import**: When you import an SSH key into 1Password, it's [automatically encrypted for you](https://support.1password.com/1password-security/#encryption). After you import the key into 1Password, you can permanently remove the redundant copy from your disk. Select the action menu for the unencrypted key in Developer Watchtower and choose **Delete SSH key from disk**. * **Copy Encryption Command**: If you prefer to keep a copy on disk, you should encrypt the key file with a passphrase. This option copies the `ssh-keygen` command to your clipboard, including the path to your key. You can run the command in your terminal app: ```shell theme={null} ssh-keygen -pf path/to/your/key ``` The `-pf` flag prompts you to create a passphrase and specify the private key file you want to encrypt.

Import into 1Password

Storing your SSH keys in 1Password allows you to securely authenticate all your Git and SSH commands from 1Password using the [1Password SSH Agent](/ssh/agent). Your private keys never leave 1Password, are never stored locally, and are never used without your consent. Learn more [about 1Password SSH Agent security](/ssh/agent/security). If Developer Watchtower detects an SSH key that is both encrypted and a [supported key type](/ssh/manage-keys#supported-ssh-key-types), you can import the key into 1Password. Select the down arrow on the right of the item, then select **Import**. After you import the SSH key, you can [remove the redundant copy of the key](#already-exists-in-1password) from your local disk.

Already exists in 1Password

1Password compares the public fingerprint of the SSH key on your local disk with the fingerprints of your SSH Key items in 1Password to determine if you've already saved the key there. If Developer Watchtower indicates that a key in your local `~/.ssh` folder has already been saved 1Password, you can remove the redundant copy of the SSH key on disk. Select the item's action menu and choose **Delete SSH key from disk** to permanently remove the key from disk. #### Unsupported key An SSH key that isn't supported in 1Password can't be imported. Check the list of [supported SSH key types](/ssh/manage-keys#supported-ssh-key-types) for more information. If Developer Watchtower lets you know that a key on your local disk is unsupported, consider [generating a new SSH key](/ssh/manage-keys#generate-an-ssh-key) if you want to use it with the [1Password SSH Agent](/ssh/agent). You may also be able to convert some keys to a format 1Password does support. For example, 1Password doesn't support keys in the PuTTY format (`.ppk`), but [PuTTYgen ](https://www.puttygen.com/) lets you export your PPK keys into the OpenSSH format, which is supported. ## About `.env` file scanning If you use 1Password as part of an organization that has a local disk scanning policy enabled, some metadata for `.env` files containing plaintext secrets may be included in a [developer secrets discovery report](http://support.1password.com/developer-secrets-report/). The report is only available to people in the [Owners](https:/support.1password.com/groups/#owners) and [Security](https:/support.1password.com/groups/#security) groups of the account. Secret values are never collected or revealed. Developer Watchtower scans your `$HOME` directory for `.env` files that contain plaintext secrets in the following locations: * `~/code` * `~/dev` * `~/Developer` * `~/git` * `~/projects` * `~/Projects` * `~/repos` * `~/src` * `~/work` It also checks for any variant matching the `^\.env(\..+)?$` pattern, such as `.env`, `.env.local`, or `.env.production`. 1Password only provides alerts for `.env` files that contain values likely to be sensitive, like API keys or tokens. The following files aren't surfaced: * Files that contain only non-sensitive values, such as `NODE_ENV=development`. * Files whose values are already managed by 1Password. ## Learn more * [1Password for SSH & Git](/ssh) * [Manage SSH keys in 1Password](/ssh/manage-keys) * [1Password Environments](/environments) * [Access secrets from 1Password through local .env files](/environments/local-env-file) * [Use Watchtower to find account details you need to change](https://support.1password.com/watchtower/) ## Related topics - [Set up your team to use 1Password developer tools](/get-started/secure-developers.md) - [1Password developer quickstart](/get-started/developer-quickstart.md) - [Get started with 1Password developer tools](/get-started.md)