Your .env file is publicly accessible: how to fix it
Critical
Your web server returns your .env file to anyone who asks. Unspill only reports the variable names, never the values, but anyone else can read them.
Why it matters
This happens when a project is uploaded or built with .env inside the public/static folder, or with a hosting setup that serves every file in the project directory.
Quick fix
- Delete .env from the deployed/public directory and redeploy.
- Rotate every secret that was in the file.
- Add .env* to .gitignore and keep env values in your host's environment-variable settings.
Step by step
1. Remove and redeploy
Make sure .env is not inside public/, dist/, build/ or your upload folder. Configure environment variables in your host's dashboard (Vercel/Netlify: Project → Settings → Environment Variables).
2. Rotate everything
Assume every value in the file is compromised: database passwords, API keys, JWT secrets.
3. Prevent it
Add these lines to .gitignore:
.env
.env.*
!.env.examplePrompt for your AI builder
Paste this into Lovable, Bolt, v0, Cursor or Replit, then review the changes before deploying.
My .env file is being served publicly. Make sure no .env files are inside the public or build output directory, add .env* (except .env.example) to .gitignore, read configuration from the hosting provider's environment variables instead, and list every secret I need to rotate.FAQ
Unspill says my /.env is safe but my app is a single-page app. Is that right?
Single-page apps often answer every URL with index.html. Unspill detects that and only reports /.env when the response actually looks like an env file (KEY=value lines), not HTML.