Open yoursite.com/.env in a browser. If you see lines like DB_PASSWORD=... or API_KEY=..., the file is public and anyone can read every secret in it. Block it at the web server first, then change every password and key in the file, because you can't know who has already read it.
What's the problem
Your site's .env file, which holds database passwords, API keys and other secrets as KEY=value lines, can be downloaded by anyone who asks for it.
Why it happens
- The
.envfile sits in the folder the web server serves, instead of one level above it. - The server has no rule blocking files that start with a dot.
- The whole project folder was uploaded to the host, including files that were meant to stay on your computer.
- A deploy copied
.envinto the public build folder.
How to fix it
- Check it: open
https://yoursite.com/.env. A download or text page withKEY=valuelines means it's exposed. A 403 or 404 means it isn't served. - Block it now: deny every path starting with a dot in your web server (on nginx,
location ~ /\. { deny all; }; on Apache, a<FilesMatch "^\.">rule withRequire all denied). - Move it outside the public folder if your framework allows it.
- Change every secret in the file: database passwords, API keys, mail passwords, payment keys. Blocking it doesn't undo anyone who already read it.
- Check your deploy so the next one doesn't put it back.
What Preventionlabs checks
One click runs the full report on your domain. For this problem it shows files that should never be public, such as .env and .git; script libraries on your homepage with published security holes; whether HTTPS works and http visitors are sent to it; whether your site loads, how fast, and where its redirects go. It checks from the outside, so it can't see files your server only uses internally.
Run your free reportYour first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.
Sources
- Laravel: Configuration: Environment File Securityofficial docs
Your .env file should not be committed to your application's source control
- MITRE: CWE-538: Insertion of Sensitive Information into Externally-Accessible File or DirectoryCWE
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files