GUIDE · SECURITY
Exposed .env and .git: how to check and fix it
If .env or .git can be fetched publicly, keys and source code are exposed. How to check in a minute and how to fix it.
3 min readLast checked
Why it happens
Hosting services publish one defined folder. Netlify’s documentation says only files in the publish directory are deployed; on Vercel only the contents of the output directory are served statically. If a .env file or a .git folder sits in that folder, it can be published with it; the self-test below shows whether it is actually reachable.
Self-test
Append /.env and /.git/config to your app’s address and open them in the browser. You expect an error page (“not found”). Some apps serve the home page for unknown addresses anyway, so the content decides. If you see lines such as NAME=value or a [core] section, the file is public.
How to fix it
Remove the files from the folder that is served and check again after the next build. Which folder is served is set in your hosting settings (publish or output directory).
Rotate keys
If a key was in the .env, assume it is known. Fix the cause first, then create a new key, replace it everywhere and delete the old one.
What the check does here
The free check requests these paths passively from the outside and reports when real file content is there, not just a home page served as a fallback.
Common mistakes
These mistakes follow from the Netlify and Vercel docs:
- On Netlify, setting the publish directory to the project root. It is relative to the base directory, which is the root (
/) by default. Everything in that folder is deployed, everything outside it is not. - On Vercel, creating a project without a build step using the framework "Other". Per the docs, Vercel then serves the
publicfolder, and if there is none, the project root. Put the files to be served in a folder of their own. - Not knowing the output directory. When a framework is detected, Vercel configures it automatically; whether it is right, you can see in the project's build settings.
Example: self-test in the terminal
Instead of the browser you can also query the response. Replace the address with your app's. A 404 is expected. If the app serves its home page for unknown addresses, you will see 200; look at the content then:
curl -s -w "\nStatus: %{http_code}\n" https://your-app.example/.env
curl -s -w "\nStatus: %{http_code}\n" https://your-app.example/.git/configFrequently asked questions
Is my .env public automatically?
No. It is only reachable if it sits in the folder your hosting serves: the publish directory on Netlify, the output directory on Vercel.
Is deleting the file enough?
No. Assume a key is known once it was reachable. Fix the cause, create a new key, replace it everywhere, then delete the old one.
Why do I get status 200 although the file does not exist?
Some apps serve their home page for unknown addresses. The content decides: lines like NAME=value or a [core] section mean the file is public.
What does the check do about it?
It requests the paths passively from the outside and reports only when real file content is there.
Sources
Check your app
The free check loads your app like a visitor and shows what is visible from the outside. You confirm beforehand that you are responsible for the app or authorised to test it.