Is your .env file publicly accessible? Free exposure check

Bots request /.env and /.git/config on every domain they find, often within hours of a deploy. If your web server serves the project folder, they get your database password and API keys. Check your own site in a few seconds.

Free check: is your live site serving .env or .git?

Deployed folders leak too. Enter your domain and we request five public paths (/.env, /.env.local, /.env.production, /.git/HEAD, /.git/config) exactly like a scanner would. You get yes or no per path; we never return or keep the file contents, and we don't store your domain.

What this checks

• /.env, /.env.local, /.env.production: served as plain text with KEY=value lines = exposed.
• /.git/HEAD and /.git/config: served = your whole repository, history included, can be rebuilt by anyone (tools like git-dumper do it automatically).

Only a real file counts. A 404, a redirect, or your app's HTML page at that path reads as "not served", so SPAs and catch-all routes don't give false alarms.

If a path shows PUBLIC

1. Rotate every key in that file first. Blocking the path doesn't un-leak what scanners already downloaded. See what to rotate and how.
2. Block dotfiles on the server. nginx: location ~ /\.(?!well-known) { deny all; }. Apache: RedirectMatch 404 /\..*$. Better: deploy a build folder, not the repo root.
3. Stop the next one at the source. Most of these start as a git add -A that stages .env. KatchPath (free) blocks that on your laptop; the Team Pack adds a GitHub Action that fails any PR adding one.

Is it safe to run?

It makes five ordinary GET requests to the domain you type, the same ones scanners already make. It tells you yes or no per path; it never shows or keeps file contents, and doesn't store your domain. Limited to 12 checks an hour.