Free tool
Exposed .env checker
Find out whether your deployed site is serving its .env file or .git folder to the public. Takes a few seconds, read-only, and tells you exactly what to do if it is.
Requests /.env, /.env.local, /.env.production, /.git/config exactly as a browser would. Read-only; nothing is stored.
Why this matters
An environment file is the one place every secret lives: database URL, API keys, signing secrets. Automated scanners request /.env on every domain they can find, all day, because it pays off often enough. A .git folder is worse: it hands over the full source history, including secrets you removed months ago. Read the guide to how env secrets still leak and how to remove a secret from git history.
Frequently asked questions
How can a .env file end up public?
Three common ways. The file is deployed to a static host inside the public folder, so it is served like any other asset. The web server is configured to serve the project root and nobody blocked dotfiles. Or a framework's build step copied it into the output directory. AI coding tools produce all three, usually because the instructions were about making the app work, not about what should never be served.
What does an exposed .git/config mean?
If /.git/config is readable, the rest of the .git directory usually is too. Tools like git-dumper can reconstruct your entire repository from it, including every commit, which means every secret that was ever committed and later removed. Treat it as a full source code leak and rotate anything that was ever in the history.
The checker says not exposed. Am I safe?
Safe from this specific leak. Secrets also ship inside JavaScript bundles as hardcoded keys, in Supabase or Firebase configs with permissive rules, and in API routes that answer without authentication. The full scan checks those; this tool only answers one question quickly.
It found my .env. What do I do first?
Two things, in order. First stop serving it: delete it from any public directory, block dotfiles at your web server, or redeploy without it. Second, rotate every secret in the file, including database passwords, API keys, and signing secrets. Do not skip the rotation because the file was only up for a short time; scanners crawl for .env files continuously.
Is this check safe to run on my own site?
Yes. It makes a handful of ordinary GET requests to well-known paths, exactly what any visitor or search engine crawler could do. It reads only enough of the response to tell whether it is an environment file or git metadata, stores nothing, and never writes to your site.
One leak of a dozen
Keys also leak through JavaScript bundles, open Supabase tables, and API routes that skip the auth check. The full scan covers all of them in about thirty seconds.
Run a free scan