Guide
Exposed .env file: what it means
An exposed .env file means your environment secrets, keys, database URLs, and tokens, are downloadable by anyone who requests the file. It usually happens when the file gets deployed as a static asset or committed to a public repo, and the fix is to remove it from what is served, rotate every secret it held, and load secrets from the host's environment instead.
How a .env file ends up public
A .env file holds your secrets in plain text. It is meant to stay on the server and never be served to a browser. In AI-built and quickly-deployed apps it goes public two common ways: it gets bundled into the deployed static files, so requesting /.env returns it, or it gets committed to a public GitHub repo where anyone can read it.
It is meant to stay on the server and never be served to a browser.
How to fix it
- Stop serving it. Make sure
.envis not in your deployed output. Add it to.gitignoreand to any deploy ignore list. - Rotate everything. Every key, token, and password in that file should be considered compromised and rotated.
- Load from the host. Put secrets in your hosting provider's environment variables and read them there, so there is no file to leak.
Then scan your live URL to confirm the file no longer returns.
Frequently asked
What happens if my .env file is public?
Anyone can download it and read every secret inside, keys, tokens, database credentials. Those secrets can then be used directly against your services. Rotate all of them and remove the file from what is served.
How do I check if my .env is exposed?
Request /.env on your live domain and see if it returns content, and check whether your repo is public with the file committed. A scanner does the first check automatically and reports if the file is reachable.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes AI code generators leave open. The first scan is free.
Scan my app