A .env file is a plain-text configuration file used by web applications to store environment-specific settings — database credentials, API keys, payment processor secrets, admin passwords. It lives on your server and should never be accessible from the internet.
When it is, the consequences can be severe.
What's typically inside
Depending on your application, a .env file might contain:
- Database hostname, username, and password
- AWS, Stripe, or Twilio API keys
- Email service credentials (SendGrid, Mailgun)
- JWT or session secrets
- Third-party OAuth tokens
None of this is meant to be public. It's the equivalent of leaving your house keys on the doormat with a label that says "front door key."
How it ends up exposed
Usually by accident. A developer deploys a project without checking what's publicly accessible. The web root contains the .env file alongside index.php, and because the server doesn't know to protect it, anyone who types yourdomain.com/.env can download the file.
Automated scanners check for this constantly. It's one of the most commonly exploited misconfigurations on the web.
What an attacker can do
- Log into your database directly and read, alter, or delete all data
- Use your API keys to rack up charges on your cloud accounts
- Access your infrastructure (S3 buckets, EC2 instances)
- Send spam using your email service credentials
A single exposed .env file can hand an attacker complete control of your application.
How to check — and what to do if it's exposed
threatprobe.app's free scan checks for .env and dozens of other commonly exposed sensitive paths. If it finds one, the fix is two steps: block direct access at the web server level, and immediately rotate every credential stored in the file.