SniffPupIs your .env public? Free .env exposure checker
Paste your live URL to check whether your environment file or Git metadata can be downloaded by anyone. It's passive: SniffPup requests a short, fixed list of well-known file paths, the same way any visitor could, and never tries to guess passwords or get around a login.
This runs SniffPup's normal free scan, so you get the whole report, not just this one check. File results are listed as “Environment file … is publicly downloadable”, “Git repository metadata is publicly downloadable” and similar. The free report lists every issue it finds with its severity and shows the full explanation and fix for the most serious one. Only scan sites you own or are authorized to test. What the scanner does and never does.
What this checks
/.env,/.env.local,/.env.productionand/.env.developmentat the root of your site. If one is public, the report shows the variable names, never the values./.git/configand/.git/HEAD, which can let someone rebuild your source code and history./.npmrc, which can contain a registry auth token, and/.DS_Store, which lists file names.- As part of the same free scan: secret keys in your page HTML and same-origin JavaScript, which is where frontend environment variables end up after a build.
What it can't tell you
- It only checks the root of the site you enter, not subfolders, other subdomains or other file names (like
config.jsonor backups). - It can't see environment variables kept on your server or in your host's dashboard. That's where secrets should be.
- It can't tell whether a leaked key was already used. A clean result means none of these files were downloadable at scan time, not that the site is secure.
Check it yourself
From a terminal, against your published URL:
curl -s https://your-app.com/.env | head -5 curl -s https://your-app.com/.git/HEAD
If you see lines like API_KEY=... or ref: refs/heads/main, the file is public. If you see your app's HTML, that path is just your app's normal fallback page.
How to fix a public .env
- Remove the file from the folder your host publishes (often
public/,dist/or the project root on static hosts), or block dotfiles in your host's config. - Revoke and reissue every key that was in it. Assume they were copied.
- Keep secrets in your host's environment variable settings, and only use them in server-side code.
- Scan again to confirm the files are gone.
More detail: how to find exposed API keys on your website.
Questions
Which files does this checker request?
A short fixed list at the root of your site: /.env, /.env.local, /.env.production, /.env.development, /.git/config, /.git/HEAD, /.DS_Store and /.npmrc. It does not guess other file names or crawl folders.
Does SniffPup store or show my secret values?
No. If an .env file is public, the report lists only the variable names it contains, never the values.
My site returns a page for /.env. Is that a leak?
Not necessarily. Many single-page apps return their normal HTML page for every path. SniffPup only reports an .env file when the response actually looks like one (KEY=value lines), not when it's your app's HTML.
My .env file was public. What should I do?
Remove it from your published files or block it at your host, then treat every value in it as leaked: revoke and reissue each key at its provider and update your server-side config. Removing the file alone doesn't undo the exposure.