Did AI leave my .env file public?

Updated 2026-10-17

Short answer: open yourdomain.com/.env in a private window, and if it downloads, rotate every key in it.

AI coding tools check that the code runs. They don't check what the live site serves. So a change can pass every test and still break the site, and the AI reports the job as done.

How to check it yourself

  1. Open /.env, /.git/config and common backup names on your live site.
  2. Any file that downloads is public. Rotate every key in it.
  3. Remove the file and block the folder in your server or host settings.
  4. Check your build output: the file got there from your deploy.

What Preventionlabs shows

Preventionlabs checks for leaked files on your live site: .env, .git, backups and server status pages. It shows leaked keys masked, never in full. Each report lists problems first, with the evidence and what to do, and shows what changed since the last report.

It tries common file names, so an oddly named backup can slip past.

Give your AI agent the Preventionlabs MCP server and it runs the same check itself after it deploys.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers