Skip to content
VibeVigil
Log inSign up

Guides · VibeVigil

Can people download my .env file?

They can if the host serves it. A scan requests /.env and /.git/config and ignores an HTML page that is not the file.

Scan a site you own. It is free. No account.

You see the report first. Saving the site is optional.

No account. The report is the next page.

Free, no account. We fetch the public page, its scripts, and a few well-known paths.

They can, if your host serves the file.

A .env file often holds database passwords and secret keys. It should never be on the public web. The same is true for .git/config. That file can point at a private repo.

What a scan does

The scan requests a short list of paths, including /.env and /.git/config. It uses a normal read. It does not guess passwords.

Some apps return the home page for every bad path. That HTML shell is not treated as a leaked file. A real env file or git config is.

Source maps can also leak source code. The scan checks for those too.

What to do

Remove the file from the public host. Rotate any secret that was in it. Tell your coding agent not to commit .env and not to copy secrets into client code.

The page explains the check. A scan uses your URL.

You see the report before you make an account.

Can people download my .env file? · VibeVigil