Is your .env file exposed?

By Shinobi Tech, the team behind AppLeakWatch. Updated .

Try opening yourdomain.com/.env. If you see your settings, every key in that file is compromised. Block the file, then replace each secret, because removing it doesn't undo a download.

Why this happens

It usually happens when a project folder is served directly, or a stray file gets deployed. Automated bots look for this address on sites all over the internet.

How to check

  1. Run this on your own domain:
    curl -i https://yourdomain.com/.env
  2. A 200 response with lines like KEY=value means it's exposed.
  3. A 200 response showing your normal homepage HTML is a catch-all page, not a leak. Look at the content, not only the status.
  4. Try .env.local, .env.production and .env.backup too.

How to fix it

  1. Remove the file from the deployed folder, or serve only your build output.
  2. Add a rule that blocks every path starting with a dot.
  3. Replace every secret in the file, including database passwords.
  4. Add .env to .gitignore.

Prompt for your AI tool

Make sure no .env file or other dotfile can be served by this app. Serve only the build output, block paths starting with a dot, confirm .env is in .gitignore, and list every secret I need to replace.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

I deleted it. Am I safe?

Not yet. Assume it was copied and replace everything in it.

Does this affect one domain only?

Check every domain and preview address your app runs on.

Related guides