Is your .env file public?

Why it matters

Exposed .env files are one of the most common causes of serious breaches: one request hands an attacker your database password, payment keys and cloud credentials.

Bots scan the internet for /.env around the clock, so if yours has been public for any length of time, assume the secrets in it have already been collected.

What this check looks at

• /.env plus common variants: .env.local, .env.production, .env.prod, .env.backup, .env.bak, .env.old
• Common subfolders: /app/.env and /api/.env
• Each response's content, so a site that returns a normal page for every address isn't flagged by mistake

How to fix it

Blocking the file isn't enough if it was ever public: rotate every password, key and token it contained.

# Deny every dotfile and dot-folder except /.well-known
location ~ /\.(?!well-known) {
    deny all;
    return 404;
}

# Deny every dotfile and dot-folder except /.well-known
RedirectMatch 404 /\.(?!well-known)

These hosts only serve your build output folder (for example dist/, build/, out/ or public/).
Make sure .env and .git are never copied into that folder, and don't set the
output directory to your project root.

// Serve static files without exposing dotfiles
app.use(express.static("public", { dotfiles: "deny" }));