for any web app

Is your .env file public?

No signup 路 no repo or GitHub access needed 路 passive, read-only checks 路 results in under a minute

See a sample report

Paste your link and we'll check whether your .env, .git or other config files can be downloaded. Under a minute, no sign-up.

Only scan apps you own or have permission to scan.

why.txt

How .env files get exposed

Some deploys copy the whole project folder to the web root, including .env, .git and backup files. Anyone who guesses the path can download them.

If we find an .env file, the report lists the variable names only. Values are hidden.

what_we_check.log

What the free scan checks

  • Files left on the server

    Things like /.env, /.env.local, /.env.production, /.git/config, .npmrc, docker-compose.yml, backup files, and package.json or lockfiles.

  • Public source maps

    We check whether a source map for one of your JavaScript files can be downloaded, which would expose your original source.

  • Leaked keys in your frontend

    Your page HTML and up to 15 of your own JavaScript files are checked for Stripe live secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.

  • Supabase service_role key

    A Supabase service_role key in your client code is flagged as critical. That key skips Row Level Security entirely.

  • Security headers and CORS

    HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.

checklist.txt

If a file is exposed

  1. Rotate every secret in it. Assume all values in an exposed .env are compromised.
  2. Remove it from the web root. Deploy only your build output.
  3. Block dotfiles. Configure your host or server to refuse paths that start with a dot.
  4. Check .git too. An exposed .git folder can reveal your source code and history.
  5. Scan again. Run the free scan after you redeploy.
faq.txt

FAQ

Which files do you check?
/.env, /.env.local, /.env.production, /.git/config, /.git/HEAD, .svn, .DS_Store, phpinfo pages, .npmrc, docker-compose.yml, common backup files, package.json and lockfiles.
Do I need to sign up?
No. Paste your link, confirm it's your app (or you have permission), and run it. Adding your email is optional and shows the risk breakdown and one problem by name.
What does it cost?
The scan and your score are free. The full list of findings with a fix for each is a one-time $9, or $29 for a pack of 10 reports.
Does it attack my site?
No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.
What doesn't it check?
Pages behind a login, third-party scripts, your server code and your database policies directly. A good score is not a guarantee of security.

Run the free scan