Skip to content

Scan rule · RSC-SEC-055

.env file committed

SecuritySeverity: HighCWE-538

Detects a `.env` with real values in the source tree (not `.env.example`).

Scan tier

Source code from source mapsRepo access (deep scan)

How to fix it

Add it to `.gitignore`, purge it from history, and rotate the keys.

Scan your own app for free

More rules in this dimension

RSC-SEC-001

No end-to-end HTTPS

RSC-SEC-002

HSTS header missing

RSC-SEC-003

No Content-Security-Policy

RSC-SEC-004

MIME sniffing not disabled

RSC-SEC-005

No clickjacking protection

RSC-SEC-006

CORS wildcard on the public document