.env and .git files served publicly
Your deployed site hands out its .env file or .git folder to anyone who asks.
Where it shows up: Any host (most common with custom servers and misconfigured static hosting)
Last updated
What it is
A .env file holds your secrets. A .git folder holds your code's full history, including files you deleted and secrets you committed by accident.
Neither should ever be part of a deployed site, but some build and hosting setups copy the whole project folder, dotfiles included.
How often we see it
We ran Shippable's static checks on about 1,460 public GitHub repos built with five AI tools (October 2026). Each figure is the share of that builder's repos where the check fired at least once. A dash means it wasn't among that builder's most common findings. Full method and breakdown: Which AI builder ships the safest apps?
What an attacker sees
If yourapp.com/.env loads, every secret in it is public. If yourapp.com/.git/config loads, the rest of the repository can often be rebuilt from the same folder.
How to fix it
Paste this into your AI tool:
My deployed app is serving .env or .git files publicly. Make sure these files are never included in the production build or deploy output (exclude them in the build config and block dotfiles at the host or CDN), and confirm the paths return 404 after redeploy. I will rotate any exposed secrets myself.
Or by hand:
- Rotate every secret that was in the exposed file.
- Exclude dotfiles from your deploy output, and block them at your host or CDN.
- Redeploy, check that /.env and /.git/config return 404, then re-scan.
Check your app
Shippable requests a short, fixed list of paths: /.env, /.env.local, /.env.production and /.git/config. It confirms the response is really that file, not your app's normal page.
This check depends on your host, so scan your deployed app:
Or scan your live app in the browser: