.env file publicly retrievable
Scan rule · RSC-SEC-013
- Security
- Severity: Critical
- CWE-538
Requests known env paths and confirms hits by KEY=VALUE line signatures.
Why this matters
A .env file keeps an app's secrets — API keys, database passwords, tokens — separate from the code. If it is retrievable over the web address, that separation is worthless: anyone can open it in a browser.
We only report this when we can prove it. The scan fetches the path and checks the content for actual environment-variable lines. A pretty 404 page, or an app that returns HTML for every request, deliberately triggers nothing here.
The cause is almost always deployment: the whole project directory gets copied to the web root instead of just the build. Short term: block the path. Properly: ship build artifacts only — and treat every key that was in that file as compromised and rotate it.
Scan tier
- Active (after domain proof)
How to fix it
Remove the file from the deployment, treat the keys as compromised, and rotate them.