Guide · Private files

Is your .env file public?

Short answer: Open https://yourdomain.com/.env and https://yourdomain.com/.git/config in a private browser window. Both should say "not found". If either downloads, everything in it is public: rotate every password and key in the file today, then block the files in your server configuration or stop deploying them. Bots request these exact addresses on every site, all day.

Run the free quick check → See the steps
Updated 25 October 2026

What to do, step by step

This happens when the whole project folder is uploaded as the website, which is common with FTP uploads, simple Docker images and some static hosts.

  1. Test the usual addresses

    Try /.env, /.env.local, /.env.production, /.git/config, /.git/HEAD, /backup.zip, /db.sql, /phpinfo.php, /wp-config.php.bak, /admin and /phpmyadmin. Each should answer "not found" or ask for a password.

  2. If a secrets file opened: rotate everything in it

    Database passwords, API keys, mail passwords, session secrets. Assume they were copied. Change them at the source, then deploy with the new values.

  3. If .git opened: assume your code is public

    Anyone can rebuild your repository from it, including any keys ever committed. Rotate those too, and scan the history with gitleaks.

  4. Block hidden files at the server

    For nginx: 

    location ~ /\.(?!well-known) { deny all; }

    For Apache, in .htaccess: 

    <FilesMatch "^\.">
  Require all denied
</FilesMatch>

  5. Stop shipping them

    Publish only the build output folder (dist, build, out, public), add a .dockerignore that excludes .env* and .git, and keep secrets in your host's environment settings.

What vibeship checks for you

You can do all of the above by hand. If you'd rather start with a list of what's wrong, the vibeship quick check runs from outside, the way a stranger sees your site. The quick check is free and needs no account. It shows your grade and how many problems sit in each area; what each problem is and how to fix it is in the full report.

Checked automatically

  • Sixteen well-known private addresses (.env, .git/config, admin tools, debug and API description pages) in the free quick check
  • Thirty more debug, backup and leftover-file addresses in the passive scan
  • Reports pages that answer but ask for a password separately from pages that are wide open
  • Never downloads or keeps what a found file contains

Deeper, and what we don't check

  • Only well-known names; a backup called something unusual is not found
  • The extensive scan follows links further and runs a real break-in test
Run the free quick check → See a demo report

Questions people ask

My .env returns my homepage instead of "not found". Is that OK?

Usually yes: single-page apps answer every address with the app. Check what actually downloads. If you see your homepage, the file is not exposed.

Is a .env file in a Next.js or Vite project exposed?

Not as a file, if you deploy the build output. But any variable named NEXT_PUBLIC_… or VITE_… is copied into the browser code. Details.

How quickly do bots find an exposed .env?

Requests for /.env and /.git/config appear in almost every web server's logs within hours of a new site going live.

Best effort, not a guarantee: Our scans are best effort: they can miss a weakness or flag one that isn't there. This is advice, not a guarantee, and it doesn't replace a security firm. Your site's safety stays your responsibility. Read the terms.

Sources

Sources checked on 25 October 2026.

Related guides