What is an exposed .env file?
An exposed .env file means the file that holds your secrets can be downloaded from your live website. Anyone who types yoursite.com/.env into a browser gets your keys and passwords. Automated bots scan for this constantly, so an exposed file is usually found within hours.
ON THIS PAGE
What it means
A .env file is a plain text list of your secrets. It is meant to stay on your server or your computer.
It becomes public when it ends up in the folder your web server hands out, such as public, dist or the site root, or when the server is set up to serve every file it finds.
Why it matters for vibe-coded apps
It can happen quietly during a deploy, when a build step copies everything into the public folder, and nothing on the site looks wrong.
- Every key in the file is exposed at once, including database and payment keys.
- Bots exploit leaked keys within minutes, not days.
- You may not notice until you see strange charges or data missing.
Example
Visiting your own site, on a server that serves every file.
https://yoursite.com/.env
DATABASE_URL=postgres://admin:pa55word@db.example.com/app
STRIPE_SECRET_KEY=sk_live_51Hx…# nginx: block every file that starts with a dot
location ~ /\. {
deny all;
}Better still, keep .env files out of the folder your server shares in the first place.
How to check if your app has this problem
- 1Open yoursite.com/.env in a private browser window. You should get a not found page, not text.
- 2Try /.env.local, /.env.production and /.git/config too.
- 3Run a check. It tests for exposed secret files for you.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Revoke and replace every key that was in the file. Do this first, because it may already be copied.
- 2Remove .env files from public, dist and any folder your host serves.
- 3Block dot-files in your server config, or deploy with a host that only serves your build output.
- 4Add .env to .gitignore and run a check again.
Make sure no .env file can be served from my website. Check that .env, .env.local and .env.production are not in the public, dist or build folders, add them to .gitignore, and add a rule to my server or host config that denies requests for any path starting with a dot. Don't change anything else. Then list the keys I should rotate.
Check if your app has this problem
Paste your website and we'll check for exposed .env file issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Environment variablesSettings stored outside your code, used to keep secrets out of it.
- API key exposureA secret key for a paid service ends up where the public can see it.
- Service role keyA Supabase key that skips every security rule, meant only for your server.
- HTTPSThe padlock: an encrypted connection between your site and its visitors.
Related reading
Need help?
Not sure what this means for your app? Our team will explain it in plain English.