.env file publicly downloadable

Why it matters

Your environment file usually holds every secret your app has.

How to fix it

Block dotfiles at your host, remove the file from the deploy output, and rotate every key in it.

How we test it

Passive — runs in the free check, looks only at what a browser can see.