Exposed `.env` File

A `.env` file served by the web server exposes every credential the application uses: database URLs, API keys, signing secrets, cloud credentials, and more.

Business risk

This is the single highest-severity finding in most WebShield scans because a `.env` almost always contains full-access credentials. Laravel apps commonly expose `.env` when the document root is set to the project root instead of `/public`. Public research in 2025 cataloged hundreds of exposed Laravel `APP_KEY` values in the wild, with the majority sitting alongside at least one additional production credential (S3 keys, Stripe keys, database passwords). A single exposed `.env` is often the entire blast radius of a company compromise.

Technical details

Rotate before you patch. If the file was reachable for any length of time, assume it was scraped. Scanners index `.env` paths continuously. Rotate every secret in the file, then update the web server config to block dotfiles, then fix the underlying deployment problem (usually: document root pointing at the project root instead of `public/`). Finally, remove the file from git history if it was ever committed.

How to detect it

Attackers scan for a standard list of `.env` variants continuously. Probe every one of them. A `200 OK` with any content is a critical finding - the cleartext value of your API keys is public the moment the URL works once.

for f in .env .env.local .env.production .env.backup .env.old .env.dev .env.staging; do
  printf "%-20s %s\n" "$f" "$(curl -s -o /dev/null -w '%{http_code}' https://yourdomain.com/$f)"
done

for f in config.php wp-config.php config.yml secrets.json credentials.json; do
  printf "%-20s %s\n" "$f" "$(curl -s -o /dev/null -w '%{http_code}' https://yourdomain.com/$f)"
done

Common pitfalls

• !Patching before rotating. The file has been scraped - every second the web server returned 200 was a chance for a scanner to capture it. Rotate first, then patch.
• !Blocking `/.env` but leaving `/.env.local`, `/.env.production`, or `/.env.backup`. Attackers probe a list of 20+ variants. Block the whole dotfile class at the web server.
• !Having the Laravel document root set to the project root (`/var/www/laravel`) instead of `/var/www/laravel/public`. Until the document root is fixed, every block rule is a workaround.
• !Assuming the file is safe because the staging or dev variant leaked. Keys from dev and staging are often identical to production because of lazy environment propagation.
• !Forgetting that `.env` committed to git will remain in history even after deletion. Use `git filter-repo` to scrub the history, and plan on rotating anyway.

Remediation guide

location ~ /\.(?!well-known) {
    deny all;
    return 404;
    access_log off;
}

External references

• Laravel Security: Protect Your .env
• OWASP: Secrets Management Cheat Sheet

Frequently asked questions

Keep going

Verify your fix

Applied the configuration change? Run a live scan to confirm the vulnerability is patched.