← All posts

Is your .env file sitting on the open web?

Your .env file holds your secrets. Your .git folder holds your code history. Neither belongs on a live website, but they can end up there when a whole project folder gets uploaded.

Check in 1 minute

  1. Open a private window and visit yoursite.com/.env, then yoursite.com/.git/config.
  2. A 404 or your normal home page is fine. Plain text with KEY=value lines or [core] means it's public.

Fix it

  1. Remove the file from your deploy (check your public folder) and redeploy.
  2. Rotate every secret that was in it. Deleting the file doesn't un-leak them.
  3. Visit both URLs again to confirm they're gone.

Run a free scan at sniffpup.com.

Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.