Guides / .env file leak

Is your .env file public? Checking a Cursor-built app for leaked secrets

How a .env file ends up downloadable on a live site, how to test /.env yourself, and how to block it and rotate secrets.

What it is

Your .env file holds your secrets. It should never be on the live site. It leaks when the whole project folder is deployed instead of only the build output, when the file is copied into public/, or when it is committed to git. If https://yourapp.com/.env downloads a file, every secret in it is compromised. Tools like Cursor can create and edit these files for you, so it is easy to lose track of where they end up.

How to check

1. Visit https://yourapp.com/.env, /.env.local and /.env.production. You should get a 404, not a file.
2. Make sure .env* is listed in .gitignore and run git log --all -- .env to see if it was ever committed.
3. Check that your host deploys only the build folder (for example dist/ or .next), not the repo root.
4. Or run a free Cobalt Owl scan, which checks these paths.

Fix it with one prompt

Paste this into Lovable, Bolt, Cursor, v0, Replit or Claude Code:

My /.env file may be publicly downloadable. Make sure .env files are never copied into the build output or public folder, add .env* to .gitignore, and configure the host to return 404 for dotfiles. Check whether .env was ever committed to git. Then list every secret that was in that file so I can rotate each one.

Review what the AI changes before you publish. If a key was exposed, rotate it even after the fix: anyone may already have a copy.

Sources

• Git: gitignore
• Vite: Env variables and modes
• Cursor: Ignore files

Last reviewed October 25, 2026. Cobalt Owl is an independent tool and is not affiliated with the builders or providers named here.