Skip to main content
All rules

SEC-012

Environment file publicly accessible

CriticalDefault severity · Security · Secrets, HTTPS and security headers

Last reviewed

An exposed .env file means your site serves its own configuration file, usually full of database passwords and API keys, to anyone who requests /.env. Rotate every value in it, remove the file from the deployed output, make sure your build never copies the project root into the public folder, and confirm /.env returns 404.

In apps built with AI tools

It happens when a static export or a manual upload includes the whole project folder, or when a server serves the project directory instead of the build output. Agents asked to make environment variables work in production sometimes copy .env into the public folder.

What it checks

GET requests for /.env, /.env.local, /.env.production and /.env.development.

Why it matters

Anyone can download your API keys and database passwords and use them directly.

Recommended fix

Remove .env files from the public web root immediately and rotate every credential they contained.

How to verify

Request /.env on the live site and confirm it returns 404; rotate every key that was in the file.

Example fix prompt

Generic prompt (your report adds the evidence)
Please fix this production issue in my app.

Issue SEC-012: Environment file publicly accessible
Site: https://your-app.example

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: A .env file is downloadable from the production site. Remove all .env* files from the public/static output, add them to .gitignore and the deploy ignore list, and make sure the build never copies them into the public folder. Then list every key in that file so I can rotate them.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request /.env on the live site and confirm it returns 404; rotate every key that was in the file.

Questions

The file is gone now. Am I safe?
Only after you rotate every credential that was in it. Automated scanners request /.env on sites all the time.

References