Common problem

Can anyone download your .env file?

A .env file usually holds passwords and API keys. If your host serves it, anyone can open yoursite.com/.env and read every value.

Check your live app for free

Paste your link. The free summary usually takes under a minute.

How it happens

The .env file ends up inside the public or build folder that your host serves.

The host has no rule that blocks files that start with a dot.

What our scan checks

  • We ask for /.env, the same way a browser would.
  • If it opens, the report lists only the variable names, never the values.
Example fix prompt

Fix prompt from a full report

Paste this into your AI builder
In my AI app builder (Lovable, Bolt, Cursor, Replit, v0 or similar):
My .env file is being served publicly at /.env.
1. Make sure .env is NOT inside the public/static folder or the build output.
2. Add .env* to .gitignore and to my host's ignore file.
3. Block any request for dotfiles (/.env, /.git) in my host's config.
4. Show me what you changed.
(I will rotate every key and password that was in the file myself.)

The full report gives a prompt like this for every issue it finds, written for your site.

This is an automated, surface-level check of what your site shows the public. It is not a full security audit.