Is my .env file public?
If a stranger can download your .env file from your live site, every secret in it is public. Paste your URL and we'll check the env file paths a stranger would try, with the same passive free scan as the rest of ShipLatch.
Uses 1 of your 3 free scans today; a site scanned in the last 24 hours answers from that scan. Passive and read-only: we only look at what any browser can see. Only check sites you own or may test.
What this checks
One GET each to the env file paths every free scan already tries, like /.env, /.env.local and /.env.production. It counts only a real env file: an HTML page served at that path doesn't count (many hosts return your app for every URL), and neither does a file without KEY=value lines. It runs as part of the normal passive free scan, which loads your page and its scripts like a browser and makes one GET to each path on a fixed list. No logins, no crawling, no form submissions.
Check it yourself
Run this against your own site. It only reads the status and content type.
curl -s -o /dev/null -w "%{http_code} %{content_type}\n" https://your-app.com/.env200 with text/plain (or a file download) means it's public. A 404, or 200 with text/html (your app's own page), usually means it isn't. Repeat with /.env.local and /.env.production.
If it's public
Rotate every key in it first (assume someone already copied it), then stop your host from serving the file. Step by step, with a prompt for your AI builder: How to check if your .env is exposed.
Different but related: values in VITE_ or NEXT_PUBLIC_ variables are compiled into your JavaScript even when the .env file itself is safe. See Are VITE_ and NEXT_PUBLIC_ env variables public?
Questions
Is my .env file public?
It is if anyone can download it from your live site, for example at your-app.com/.env. Paste your URL above to check, or run the curl command on this page against your own site.
Are VITE_ and NEXT_PUBLIC_ variables public?
Yes. Build tools copy them into your JavaScript bundle, so anyone can read them even if the .env file itself isn't served. Only put values there that are meant to be public.
Does this use one of my free scans?
Yes. It runs the normal free scan, which allows 3 scans a day. A site scanned in the last 24 hours answers from that scan without using another one.
What else does the scan look at?
The tool answers only the .env question, but the scan behind it is the full free scan. Your grade and issue counts are shown under the answer, and the full free report has the rest.
Check everything, not just this
The full free scan also looks for leaked API keys, exposed .git folders, source maps and missing security headers. Same 3 free scans a day.