Home / patterns

Exposed .env or .git on a deployed site

Quick answer: Misconfigured hosting can serve /.env or /.git/config to anyone.

Last updated October 14, 2026

Steps

Request /.env and /.git/config on your own domain.
Both should return 404.
If either loads, remove it from the deploy output and rotate every exposed secret.

Why it matters

This is a common failure pattern in apps built quickly with AI coding tools. The steps above check your own app only. Never test apps you don't own.

Want an expert to check your app?

VibeRescue checks are coming soon. Join the waitlist, or ask StorenTech AI to fix it for you.

Join the waitlist