Why Your .env File Might Be Public (and How to Check)
Your `.env` file is the master key ring — database URLs, API secrets, signing keys, all in one place. It's supposed to stay on the server. But certain deploy setups will happily serve it to anyone who guesses the URL, and bots guess that URL thousands of times a day.
How a private file ends up public
The usual culprit is serving your project's root directory as static files. If `.env` sits in a folder that the web server treats as the public web root, requesting `/.env` returns it. This bites apps deployed with a misconfigured static server, some Docker setups, and a few PHP-style hosts.
A related case: committing `.env` to a public repo, or serving the `.git` directory so its history (including the committed `.env`) can be reconstructed.
Check it in ten seconds
Visit `https://yourapp.com/.env` in a browser or with `curl`. You want a 404. If you see `KEY=value` lines, it's exposed — treat every secret in it as compromised and rotate them now.
Check the same for `/.git/config`, `/.env.local`, `/.env.production`, and any `backup.sql`. Attackers try all of these automatically.
How to fix and prevent it
Keep `.env` out of your public/served directory, and make sure `.env*` is in your `.gitignore` *before* the first commit. On hosts like Vercel, Netlify, and Render, don't ship a `.env` at all — put secrets in the platform's environment-variable settings, which are never web-served.
If a secret was exposed, deleting the file isn't enough — rotate the keys. See Stop Leaking API Keys.