Is my .env file public?

LeakWatch requests those two paths with GET, the same way it requests the public page. A response counts only when a line matches an assignment such as NAME=value. The name must start with a letter or underscore. HTML is ignored, so a styled 404 page that returns 200 is not a finding. The full file is not stored. A paid report can keep a short redacted snippet. The explanation on that finding is that an environment file is being served as a static asset.

The same scan also requests /.git/config and /config.json. Git config counts only when the body looks like git config, with a [core], [remote], or [branch] section. config.json counts only when it parses as a JSON object and the response is not HTML. An array is ignored. Source maps are requested only for scripts found on the page, and the map body is not stored.

A framework can still publish secrets without serving the file. Names prefixed with NEXT_PUBLIC_ or VITE_ are inlined into the JavaScript the browser downloads. Those are public even when both env paths 404. Do not put secrets in those names. The scan looks for credential-shaped strings in the page and its scripts separately from this file check.

If a path answers with a real env file, remove it from the web root and from the hosting publish directory, configure the server so dotfiles are not served, and rotate every credential that was in the file. Rotating a key that stays in the published file does not close the finding.

Run the exposed .env checker on a deployed URL you have permission to test, or start from the homepage scan. One free scan is allowed per network every 30 days. LeakWatch is not a certification.