How to check if your .env is exposed

One URL check that tells you if your production host is serving your secrets file — and how to fix it.

If https://your-domain/.env returns a file full of KEY=value lines, those secrets are public. Same for /.git/HEAD (which often means the whole git history is downloadable).

Check

1. Open https://YOUR_DOMAIN/.env in a private window.
2. Open https://YOUR_DOMAIN/.git/HEAD. A response like ref: refs/heads/main means .git is exposed.
3. If either works: rotate every secret in that file before you do anything else.

Fix

• Ensure .env is in .gitignore and never copied into public/, dist/, or static/.
• Configure the host/CDN to 404 dotfiles (Vercel/Netlify normally do; raw object storage and some VPS setups do not).
• Redeploy from a clean build.

Make sure .env and .git can never be served as static files. Add .env to .gitignore. Configure the host to return 404 for paths starting with /. List every secret that must be rotated if .env was ever public.

Related: Hide API keys · service_role

More guides

• Is my Lovable app secure?
• How to enable Supabase Row Level Security (RLS)
• Exposed Supabase service_role key: what to do now
• Lovable security checklist