Exposed .env, .git and backup files checker
Last updated
Enter a URL to check a fixed list of paths that leak secrets when they are public, including /.env, /.git/config, SQL dumps, backups, logs, private keys, source maps, open directory listings, Swagger docs and metrics. It only requests those paths; it never guesses passwords or sends attack payloads.
Why these files leak
Static hosts serve whatever is in the output folder. A build script that copies the project root, a backup left on the server, or a framework debug route turned on in production can publish credentials and source code without anyone noticing.
Single-page apps answer every unknown path with their homepage. Defexity compares each response with that fallback page, so a homepage served at /.env is not reported as a leaked file.
Questions
- What should I do if a .env file is public?
- Rotate every key in it first, then remove the file from the deployed output and redeploy. Assume anything in it has been copied.
Related Defexity checks
- SEC-012: Environment file publicly accessible
- SEC-013: Git repository metadata publicly accessible
- SEC-014: Sensitive file publicly accessible
- SEC-015: JavaScript source maps are public
- SEC-024: Directory listing is enabled
- SEC-032: Log files are publicly downloadable
- SEC-033: Cloud or registry credentials file is public
- SEC-034: Docker or CI configuration is public
- SEC-035: Private key file is public
- SEC-036: Site backup archive is downloadable
- SEC-037: Subversion or Mercurial metadata is public
- SEC-038: IDE project files are public
- SEC-048: API documentation is public
- SEC-049: Server metrics endpoint is public
Defexity reports potential risks it can see from outside your app. It is not a guarantee of security and not legal advice.