Exposed .env files: how attackers find your secrets
An .env file holds database passwords, API keys, and signing secrets. If it's reachable over the web — at /.env, /.env.production, or a backup like /.env.backup — anyone can download it and take over your services.
What it is
Environment files are meant to stay on the server and never be served to clients. A misconfigured static handler, a stray copy in the web root, or a framework that serves dotfiles can expose them.
Attackers don't guess — they run automated scans that request /.env and dozens of variants against millions of hosts continuously. A reachable file is found within hours.
Why it matters
These files routinely contain production database URLs, Stripe secret keys, JWT signing secrets, and cloud credentials. One leak can mean full data theft, fraudulent charges, and account takeover.
Because the secrets are valid until rotated, the damage continues long after the file is removed unless you rotate everything it contained.
How to fix it
Deny access to .env and other dotfiles in your web server or proxy config.
location ~ /\.(?!well-known).* {
deny all;
return 404;
}Store configuration outside any directory the server serves statically, and make sure your build doesn't copy .env files into the published output.
If a file was ever reachable, treat every secret in it as compromised and rotate database passwords, API keys, and tokens immediately.
FAQ
I removed the file — am I safe?
Not until you rotate the secrets. Anyone who downloaded it still holds valid credentials until you change them.
How would I know if mine is exposed?
Request https://yourdomain.com/.env in a browser. If you see KEY=value lines instead of a 404, it's exposed. AppSafe checks this automatically.
Is your app affected?
AppSafe checks for this and dozens of other issues in one free scan.
Scan my app freeFrom the blog
Fake AI crawlers are hunting your .env files. Here's how to check yours
Credential scanners are borrowing the names of AI crawlers to slip past allowlists, and they're asking for one file in particular: your .env. How to check whether yours is reachable, and how to lock it down.
The Railway breach: how to rotate your app's secrets without downtime
Railway told every user to roll their environment variables after attackers went after AI and platform API keys. How to check your exposure, rotate everything without taking your app down, and make the next breach hurt less.
PHP2Shell is being exploited: how to check if your app is exposed
Two critical bugs in PHP itself went from "patch released" to "exploited in the wild" in days. How to find out whether anything you host runs an affected version, and what to do about it today.
Shipping an AI-built app? Check these 7 things before you launch
AI coding tools optimize for "it works," not "it's safe to ship." These are the seven issues we check for first on any freshly launched app — and the fix for each one.
Related guides
Exposed .git directory: the source-code leak hiding in plain sight
A reachable /.git hands over your entire codebase and commit history.
Exposed database backups: what happens when /backup.sql is reachable
A reachable .sql dump is a complete hand-off of your entire database.
API keys exposed in client-side JavaScript
Anything in your bundle is public. Treat it that way.
Source maps in production leak your source code
Shipped .map files hand over your original source.