Is your .env file public? A 2-minute check

Some deploy setups copy your whole project folder to the web server. When that happens, files like .env (your secret keys) and the .git folder (your full code history) can end up publicly downloadable.

A 2-minute check on your live site:

1. Open https://yoursite.com/.env in a browser.
2. Open https://yoursite.com/.git/config.
3. If either one shows text instead of a 404, it's exposed.

If it is:

• Rotate every key that was in that file, starting now.
• Block dotfiles on your server or host, or deploy only your build output folder.
• Check your logs to see whether anyone fetched them.

Hosts like Vercel and Netlify usually don't serve these files, but custom servers and some one-click setups can.

Want a second look? LaunchMedic checks for exposed files and broken pages. Your first scan is free, then $9 for 1 check or $40 for 5, one-time.