Exposed .env Checker
Is my .env file exposed?
An environment file is only private while something refuses to serve it, and a static host or misconfigured route will hand over /.env to anyone who asks - as will a published source map or a forgotten database backup in the web root. This checker requests those paths on your domain and reports which ones answered with real content.
What this checker requests
Dotenv files in the web root
Requests .env, .env.local, .env.production, and .env.development, and confirms a hit only when the response actually contains key-value lines.
Exposed .git metadata
Requests .git/HEAD and .git/config. A readable .git directory hands over your commit history, including secrets that were committed and later removed.
Backups and database dumps
Requests common leftovers such as backup.sql, database.sql, dump.sql, backup.zip, and db.bak that get uploaded during a migration and never deleted.
Published source maps
Checks for .map files served alongside your bundles, which reconstruct your original source - comments, file names, and any secret inside them.
Read more →Env values inlined into the bundle
Scans your shipped JavaScript for provider keys and generic SECRET, API_KEY, DATABASE_URL, and JWT_SECRET assignments that a bundler inlined at build time.
Read more →Debug routes that print your environment
Probes paths like /api/env, /api/config, /api/info, and framework actuator endpoints that return process environment or configuration as JSON.
How the Exposed .env Checker works
- Step 1
Paste your domain
The live URL is the only input. No repository access, no environment file upload, no hosting credentials, and no Ubserve account.
- Step 2
We ask your host for the files it should refuse
We request each dotfile, git path, backup name, and debug route in turn and read the response - a 404 is a pass, and a body containing key-value lines or a stack trace is a finding. In parallel we download your JavaScript bundles and scan them for env values that were inlined at build time.
- Step 3
You get the report, partially unlocked
You see the issue count, a letter grade, and up to two findings in full, free. The rest - including the highest-severity findings and the copy-paste fix prompts - unlocks with a one-time report unlock or a plan.
Frequently asked questions
How do I know if my .env file is exposed?
Ask for it. Open https://yourdomain.com/.env in a private browser window. A 404 or a redirect means your host is refusing, which is what you want. If you get lines that look like KEY=value, that file is public and has been public for as long as it has been deployed - assume every value in it is compromised and rotate them. Repeat with /.env.production, /.git/config, and /backup.sql, which fail the same way for the same reason.
How does an environment file end up public?
Usually because the file was copied into the directory the web server serves. A build that runs at the project root and deploys that whole root will publish every dotfile in it; a static host with no rule about hidden files will serve them like any other asset; a Docker image built with COPY . . carries the .env into the container. The second route is the bundler: if a server-only value is referenced from client code, its literal value gets inlined into the JavaScript at build time, so the file stays private while its contents ship anyway.
How does the checker work?
It runs the standard Ubserve public scan. We request each dotfile, git path, backup filename, source map, and debug route against your origin and read the response, treating a hit as real only when the body contains matching content - key-value lines for a .env, a stack trace or configuration payload for a debug route. Separately we download the JavaScript bundles your page links to and match them against provider key patterns and generic secret-shaped assignments.
Is it free? Do I need to sign in?
The scan is free and you do not need an account to run it. You get the issue count, a letter grade, and up to two findings shown in full - location, evidence, and severity - at no cost. The rest of the report stays locked, including the highest-severity findings and the copy-paste fix prompts you can hand to your AI coding tool. Unlocking everything is a one-time payment for that report, or a plan if you want repeat scans and monitoring.
Does Ubserve store the contents of my .env file?
We store what we need as evidence and nothing more: the path that answered, the response status, and a short excerpt showing the finding is real - not the full file. The same rule applies to a key found in a bundle, where the record is the pattern matched and its location. Everything we can see was already being served publicly by your host, which is the reason the finding exists. Beyond that, this scan reads only public URLs: no repository, no database password, no hosting credentials, and no app login.
My .env is public - what should I do first?
Rotate before you fix. Every value in that file should be treated as compromised the moment you confirm it was served, because you cannot know who fetched it or what has it cached, and blocking the path afterwards does not recall a copy. Rotate in order of blast radius - payment and cloud credentials, then database and service-role keys, then everything else - and only then stop the file being served. Our fix guide walks through the order and what to check for misuse afterwards.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →Exposed API Key Scanner
Downloads your deployed JavaScript and matches it against key patterns for 30+ providers, from Stripe to OpenAI to AWS.
Open tool →
AI BuildersReplit Security Scanner
Checks a Replit deployment for secrets in the bundle, config files served from the web root, and open debug routes.
Open tool →Website Vulnerability Scanner
The full public scan: bundles, headers, TLS, CORS, endpoints, DNS, and database exposure in a single pass.
Open tool →Keep reading
- I exposed an API key - what now?The rotation order that limits the damage.
- How to remove exposed API keys from your frontendGetting a secret back behind a server route.
- Stripe secret key exposureWhat sk_live in the open actually costs.
- Supabase service-role key exposureThe key that ignores every policy you wrote.
- Pre-deploy security checklist for vibe-coded appsThe last pass before you ship.
Run the Exposed .env Checker
Paste your URL and see what your app is handing to the public. Free, no account, no repo access.