Checks

Exposed env file

A request to /.env, /.env.local, or /.env.production returned 200 and KEY=value lines, and the body was not an HTML app shell.

In plain language

A request for an env file returned KEY=value lines. The values are not stored in this report.

An exposed env file is the whole secret set: database URLs, service keys, and third-party tokens.

A generic fix prompt

Paste this into your coding agent, or apply it by hand:

A public URL is serving an env file. Remove it from the web root and from any static hosting publish directory. Rotate every secret that was in the file. Add the env filenames to your host's deny rules.