snag.page

Every check ยท Exposed files

Environment files

exposure/dotenv

What it checks

/.env, /.env.local, /.env.production

Why it matters

It holds the site's settings, which usually include passwords and API keys.

How to fix it

  1. Block files whose names start with a dot in the web server, or move the file out of the web root.
  2. Change every password and key in it: they have been public.
  3. Check your access logs for who fetched it.

Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users