An exposed .env file: Crawl Audit check 169

Short answer: a .env file holds your app's settings, usually including database passwords and API keys. If it sits in the public folder, anyone can download it. Check 169 tests for one in the full audit and fails if it's reachable.

What Crawl Audit checks

• It runs only in the full audit, and only when the site owner has agreed to it. The free check shows that it runs in the full report.
• It requests /.env.
• Fail: it loads and isn't an HTML page.
• Pass: it doesn't load, or the server returned a normal web page instead (as sites that answer every address with a page do).

What the sources say

• Palo Alto Networks Unit 42, August 2024: an extortion campaign "targeted 110,000 domains resulting in over 90,000 unique variables in the .env files." Of those, "7,000 belonged to organizations' cloud services".
• Unit 42's advice: "organizations should follow security best practices to never expose environment files publicly."
• OWASP, on what to do after a leak: "Keys that were exposed should undergo immediate revocation."

Fixing it

• Keep .env outside the public folder. Most frameworks expect it one level above.
• Block dot-files at the server, except /.well-known/, which some services need.
• If it was ever public, change every password and key in it first, then remove the file. Removing it alone isn't enough, because it may already have been copied.

On devmarde.com

/.env returned a 404 on our site on 6 October. It passes.

Sources

• Unit 42, Leaked environment variables allow large-scale extortion operation in cloud environments (15 August 2024).
• OWASP, Secrets Management Cheat Sheet, checked 6 October 2026.