# .env file publicly accessible, how it happens and how to fix it

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

Why a settings file can end up at a public address on your site, the build and hosting mistakes behind it, and the order to fix it in.

If your `.env` file loads at a public address, every value in it is public. Remove it from the live site, then replace every secret it held. Attackers try common file names on every site they visit, like `/backup.zip`, `/.env` or `/.git/`.

## How does it end up online?

Nearly always by being copied into a folder the host serves as-is.

| How it happened | Why it is public |
| --- | --- |
| The file sits in a Vite `public` folder | Vite serves everything in the `public` directory at the root path and copies it to the build output as-is. |
| The file sits in a Next.js `public` folder | Next.js serves files inside `public` from the base URL `/`. |
| The whole project folder was uploaded to a plain web host | The host serves every file it was given |
| A server serves the project folder instead of the build output | The root of the project becomes the root of the site |

Next.js notes that its default template adds all `.env` files to `.gitignore`, and says you almost never want to commit them. Keeping it out of the repository helps, but it does not stop a copy in a served folder.

## What to do, in order

1. Delete the file from the live site, then ask whether anything in it needs replacing, because a leaked password needs changing, not just hiding.
2. Replace every key and password the file held with the service that issued it.
3. Fix the build so only the built site is uploaded, and keep settings files outside any served folder.
4. Deploy, then check that the address no longer loads.

## How to check

A Lockpick scan checks a short, careful list of common file names and never downloads more than it needs to confirm one is there. Atlas, our example app at atlas.example, is where to test this kind of mistake. Run a [quick check](/check) on your published address to see what a stranger sees, then read [how we check](/docs/security/how-we-check) for what it covers. A check that does not find the file cannot prove no copy exists under another name, so keep secrets in your host's settings rather than in files next to the site.

## Questions people ask

### My .env file is in .gitignore. Can it still be public?

Yes. Ignoring it keeps it out of the repository, but a copy in a served folder or an uploaded project folder is still public.

### I deleted the file from the server. Is that enough?

No. Anyone may already have the values, so replace every secret it held.

## Sources

- [Files you forgot were public](https://www.lockpick.app/docs/learn/files-you-forgot-were-public), Lockpick docs, read on 2026-10-06
- [How to use environment variables in Next.js](https://nextjs.org/docs/app/guides/environment-variables), Next.js docs, read on 2026-10-06
- [public Folder](https://nextjs.org/docs/app/api-reference/file-conventions/public-folder), Next.js docs, read on 2026-10-06
- [Static Asset Handling](https://vite.dev/guide/assets), Vite docs, read on 2026-10-06