Exposed .env Files

What this check looks for

StackShield requests /.env and a set of related paths directly, exactly as automated scanners do across the internet every hour. It is checking one thing with a clear answer: does your server return the contents of the environment file, or does it refuse.

A correctly configured server answers 403 or 404. A misconfigured one serves the file.

Why it matters

The .env file is the single most valuable file in a Laravel application. It holds the database credentials, the APP_KEY, mail and queue credentials, and every third-party API key. An attacker who reads it does not need an exploit; they have been handed the keys.

This is not a theoretical risk. Bots scan for /.env continuously, and a server whose document root points at the project root rather than /public, or which lacks an explicit deny rule, will be found within hours of going live. Real breaches from exposed .env files have led to full database theft, drained cloud accounts and ransomware.

What a failed check means

A failed check means your .env file, or another sensitive dotfile, was reachable over HTTP when StackShield looked. This is one of the few findings that warrants treating as a live incident: assume every secret in the file is compromised, rotate all of them, and close the exposure.

The fix is a correct document root and an explicit deny rule for dotfiles, verified from outside afterwards.

See the step-by-step remediation: how to fix this.