AppInspected

Fix guides

Your .env file can be downloaded from your website.

Last reviewed October 15, 2026 against the providers' current documentation.

The short version

Every key in that file is compromised. Remove the file from what you deploy, then rotate every secret it contained, starting with payment, database and AI keys. Taking the file down is not enough, because bots download exposed .env files within hours.

Why it matters

A .env file usually holds the most sensitive values your app has: database passwords, payment keys, AI keys, email service keys. Bots request /.env on websites around the clock because it's such a common mistake.

Fix it, in this order

  1. Check it yourself

    Open https://yoursite.com/.env in a private window. If you see lines like KEY=value, it's exposed. (If you see your normal homepage, your host is just returning the app for unknown paths; that's fine.)

  2. Remove it from the deployed files

    The file is inside the folder your host publishes, usually public/, dist/, build/ or the project root on simple static hosting. Move it out, add .env* to .gitignore, and set the values in your host's environment variable settings instead.

  3. Rotate every secret in the file

    Go through it line by line. For each key, create a new one in that provider's dashboard and turn the old one off. Start with anything that can spend money or reach user data: Stripe, database URLs, Supabase secret keys, OpenAI and other AI keys, email providers.

  4. Check your git history

    If the repository is public, or was ever public, the .env file may be in its history even after you delete it. Rotating the keys (step 3) is what protects you; cleaning history is optional after that.

  5. Block it at the host

    As a safety net, configure your host to refuse requests for dotfiles such as /.env and /.git.

Or ask your AI tool to do it

Paste this into Lovable, Bolt, Cursor, Claude Code or whichever tool built your app. Review what it changes before you deploy.

My .env file is being deployed and is publicly downloadable. Make sure no .env file is inside any folder that gets deployed (public, dist, build, static). Add .env and .env.* to .gitignore. Load configuration only from the hosting platform's environment variables. List every variable the app reads so I can rotate each secret, and mark which ones are used in the browser so I can confirm none of them are secret.

How this happens

AI tools sometimes create the .env file inside the public folder, or a static host publishes the whole project directory. Either way, the file ships with the site.

Check that it's really fixed

After you deploy, run the free check. It reads your live site the way an attacker would and tells you if any secret key is still visible.

Check my app free

Questions

I deleted the file. Do I still need to rotate keys?

Yes. If it was ever reachable, assume someone has a copy.

What about /.git?

Same problem, often worse: an exposed .git folder lets people rebuild your source code and every secret ever committed. Our free check looks for both.

Sources

Related guides