Scan rule · RSC-SEC-013
.env file publicly retrievable
Requests known env paths and confirms hits by KEY=VALUE line signatures.
Why this matters
A .env file keeps an app's secrets — API keys, database passwords, tokens — separate from the code. If it is retrievable over the web address, that separation is worthless: anyone can open it in a browser.
We only report this when we can prove it. The scan fetches the path and checks the content for actual environment-variable lines. A pretty 404 page, or an app that returns HTML for every request, deliberately triggers nothing here.
The cause is almost always deployment: the whole project directory gets copied to the web root instead of just the build. Short term: block the path. Properly: ship build artifacts only — and treat every key that was in that file as compromised and rotate it.
Scan tier
How to fix it
Remove the file from the deployment, treat the keys as compromised, and rotate them.