Environment file exposed
Requests common .env file names and checks for KEY=value lines.
Recommended next step if found
Remove .env files from the web root and block dotfiles on the server. Rotate every credential the file contained.
Exposed environment files
A publicly readable environment file may expose private configuration. Findings should be verified from the captured response, with secret values kept private.
Related public checks
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Secret key exposed in JavaScript
Searches the site's own JavaScript and inline scripts for secret keys with unambiguous formats. Public keys (Stripe pk_, Supabase anon, Firebase) are not reported.
Recommended next step if found
Revoke the key immediately, create a new one and keep it on the server only. Browser code must use publishable keys or call your own backend.
Keep the scope.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology