Skip to main content
Phisherman reads the following environment variables at startup. Required variables must be set before starting the server — the process will fail to connect to Redis if they are absent.

​
Variable reference

VariableRequiredDefaultDescription
UPSTASH_REDIS_REST_URLYes—Upstash Redis REST endpoint URL
UPSTASH_REDIS_REST_TOKENYes—Upstash Redis REST auth token
GOOGLE_SAFE_API_KEYNo—Google Safe Browsing API v4 key. If missing, the checker logs an error and returns score 0.
PHISHTANK_API_URLNohttps://data.phishtank.com/data/online-valid.csv.gzOverride the PhishTank feed URL. The default streams the compressed CSV dump.
PORTNo4000HTTP port the server listens on.
SCAN_CACHE_SAFE_RESULTSNofalseSet to "true" to cache safe verdict results in Redis. Disabled by default to reduce Redis storage.
WEBRISK_API_KEYNo—Google Web Risk API key. Used by the WebRiskChecker, which is present in source (src/checkers/googleWebRisk.ts) but currently disabled and not registered in the checker pipeline.

​
Example .env file

# Required
UPSTASH_REDIS_REST_URL=https://<your-instance>.upstash.io
UPSTASH_REDIS_REST_TOKEN=<your-token>

# Optional
GOOGLE_SAFE_API_KEY=AIza...
PHISHTANK_API_URL=https://data.phishtank.com/data/online-valid.csv.gz
PORT=4000
SCAN_CACHE_SAFE_RESULTS=false

# Disabled checker (not active by default)
# WEBRISK_API_KEY=<your-google-web-risk-key>
Never commit .env to version control. Add it to .gitignore before your first commit. Upstash tokens grant full read/write access to your Redis database.
If GOOGLE_SAFE_API_KEY is not set, checkSafeBrowsing logs "safe browsing key missing" to stderr and returns { score: 0 }. The server continues to operate normally — the Google Safe Browsing checker is simply skipped.
SCAN_CACHE_SAFE_RESULTS is off by default because safe verdicts are high-volume and low-value: caching them would consume significant Redis storage without meaningfully improving performance. Enable it only if you expect repeated scans of the same safe URLs and want to reduce latency.

Build docs developers (and LLMs) love

Get started for freeTalk to us