.env file publicly accessible, how it happens and how to fix it
If your .env file loads at a public address, every value in it is public. Remove it from the live site, then replace every secret it held. Attackers try common file names on every site they visit, like /backup.zip, /.env or /.git/.
How does it end up online?
Nearly always by being copied into a folder the host serves as-is.
| How it happened | Why it is public |
|---|---|
The file sits in a Vite public folder | Vite serves everything in the public directory at the root path and copies it to the build output as-is. |
The file sits in a Next.js public folder | Next.js serves files inside public from the base URL /. |
| The whole project folder was uploaded to a plain web host | The host serves every file it was given |
| A server serves the project folder instead of the build output | The root of the project becomes the root of the site |
Next.js notes that its default template adds all .env files to .gitignore, and says you almost never want to commit them. Keeping it out of the repository helps, but it does not stop a copy in a served folder.
What to do, in order
- Delete the file from the live site, then ask whether anything in it needs replacing, because a leaked password needs changing, not just hiding.
- Replace every key and password the file held with the service that issued it.
- Fix the build so only the built site is uploaded, and keep settings files outside any served folder.
- Deploy, then check that the address no longer loads.
How to check
A Lockpick scan checks a short, careful list of common file names and never downloads more than it needs to confirm one is there. Atlas, our example app at atlas.example, is where to test this kind of mistake. Run a quick check on your published address to see what a stranger sees, then read how we check for what it covers. A check that does not find the file cannot prove no copy exists under another name, so keep secrets in your host's settings rather than in files next to the site.
Questions people ask
My .env file is in .gitignore. Can it still be public?
Yes. Ignoring it keeps it out of the repository, but a copy in a served folder or an uploaded project folder is still public.
I deleted the file from the server. Is that enough?
No. Anyone may already have the values, so replace every secret it held.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- Files you forgot were public Lockpick docs, read on October 6, 2026
- How to use environment variables in Next.js Next.js docs, read on October 6, 2026
- public Folder Next.js docs, read on October 6, 2026
- Static Asset Handling Vite docs, read on October 6, 2026