2026-10-25 · Daily security tips

Can anyone download your .env or .git folder?

Some deploys copy the whole project folder to the web server, including .env (your secret keys) and .git (your full code history). It happens most with manual uploads, simple static hosts and self-run servers.

Check: in a private window, open your-site.com/.env and your-site.com/.git/HEAD. A 404 is good. Your normal homepage is usually just a fallback page, also fine. If you see KEY=value lines or "ref: refs/heads/main", the files are public.

Fix: deploy only your build output folder (dist, build or out), not the project root, and block dotfiles on your server or host. Keep .env in .gitignore.

If either was public, rotate every key in that .env now. Removing a file later does not remove it from git history.