Guide · Leaked keys and files

Is your .env file downloadable? Check in one minute

A .env file holds your app’s settings and keys. It belongs on your computer and your server, never on the public web. If your host publishes it, anyone who types yourapp.com/.env gets every key in it.

Why it matters

A .env file usually holds the keys you’d most want to keep: database passwords, payment and AI provider keys, email service keys. Unlike a key buried in JavaScript, a public .env file is a plain list, at an address that’s the same on every site. That’s exactly why people check for it.

How it ends up public

It’s a normal leftover of building fast. The usual causes:

The whole project folder is published, instead of only the build output (often dist/ or build/).
The file was copied into the folder that gets published (often public/).
The host serves files whose names start with a dot, and nothing blocks them.

The same mistake can publish a .git folder, which holds your full source code and its history, including any key that was ever committed.

See it yourself

Open each of these in your browser, with your own address: yourapp.com/.env, yourapp.com/.env.local, yourapp.com/.env.production and yourapp.com/.git/HEAD.

You see lines like SOMETHING_KEY=…, or ref: refs/heads/mainFix now

You see your app’s normal page, or a “not found” pageClear

Many apps show their home page for any address they don’t know. That isn’t your .env file.

Fix it

First, rotate every key in the file, in each provider’s dashboard: make a new key and delete the old one. Treat them all as leaked, because you can’t know who downloaded the file. Then remove the file from what gets published. This is the same prompt our checker gives you:

Paste this into Lovable, Bolt, Cursor or Claude Code

My .env file is publicly downloadable from my website. 1) List every key and secret in my .env files so I can rotate each one in its provider’s dashboard right now. 2) Make sure .env files are never inside the folder my host publishes. 3) Add .env* to .gitignore and block every path starting with a dot from being served.

If your .git folder is public too, use this one as well:

Paste this into Lovable, Bolt, Cursor or Claude Code

My .git folder is publicly downloadable from my website. Change my deployment so only the build output folder is published, never the project root, and block every path starting with /.git. Then tell me which secrets ever appeared in my git history so I can rotate them.

What this can’t tell you

We try the usual addresses, not every possible one. A key file under another name or in another folder wouldn’t show up. And a clean result doesn’t say whether the keys were ever public before: if in doubt, rotate them.