2026-11-02 · Daily security tips

Did a .env.production or backup file slip onto your host?

Most people check that /.env returns 404 and stop there. But static hosts serve anything that lands in the public or build folder, and copies are easy to miss: .env.production, .env.local, .env.bak, config.js.old, or a backup.zip of the whole project.

Check: run curl -sI against yoursite.com/.env.production, /.env.local, /.env.bak and /backup.zip. Anything other than a 404 (or a redirect to your homepage) needs a closer look. Also list your build output folder and look for files you did not mean to ship.

Fix: keep env files and archives out of public/ and dist/, add them to .gitignore, and set secrets in your host's environment variable settings instead.

If one was reachable, rotate every key it held.