A .env or .git served publicly
The whole account, not one key.
Why this is critical
A .env file is a complete list of your secrets in one download: database password, API keys, signing secrets. There is no partial version of this problem.
A served .git directory is worse in one way — it includes history, so secrets you committed once and removed later are still there.
Fix, then assume the worst
Remove the file from your deployed output, add it to .gitignore, and block the path at your host. Confirm the URL now returns 404.
Then rotate every credential the file contained. All of them, not the ones that look important — you cannot know who downloaded it or when.
How it usually happens
The file ends up inside a directory that gets served as static output — public/, dist/, build/. Check what your build copies, not just what your repository ignores.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site