Skip to content
LeakWatch
Sign inScan free

Checker

Exposed .env checker

Paste the deployed URL. LeakWatch requests /.env and /.env.local with GET. A response counts only when the body looks like KEY=value lines. The full file is not stored. A short redacted snippet can be kept on a paid report so you can see the file was real.

The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. One free scan per network every 30 days.

We email your report link here. One free scan per network every 30 days.

What this page is for

  • /.env and /.env.local

    These are the paths a static host sometimes publishes with the rest of the site. A 404 is the result you want.

  • Related paths in the same scan

    The scan also requests /.git/config and /config.json, and it looks for public JavaScript source maps. A git config counts only when it looks like git config.

  • What to do if one answers

    Remove the file from the publish directory, stop the server from serving dotfiles, and rotate every credential that was in the file.

Is my .env file public?

Questions

Do you keep a copy of the file?
No. The body is not saved as the file. A paid report may keep a short redacted snippet.
Is a 200 page of HTML a finding?
No. The check looks for environment-variable lines, not for any response. An HTML error page is ignored.

A Proof Report is $19 once. Monitoring is $9/month. Pro is $29/month. No subscription is required for the report. See pricing.