critical severity · fix guide
How to Stop Serving .env and .git Publicly
A file that should never be public — like your .env (which holds secrets) or your .git folder (your whole code history) — is downloadable from your live site.
Why AI tools cause it
A misconfigured host or a bad deploy can expose these. AI setups sometimes deploy the whole project folder, including files that should be ignored.
The goal
Private files (.env, .git) are not downloadable from the live site, and any secret that was in an exposed .env has been rotated.
The steps
- Stop the host from serving the spot the scan shows (fix the host config and .gitignore, and keep it out of the deploy output)
- Rotate any secret that was in an exposed .env
Fix it with your AI coding tool
Pick your tool and paste the instruction. It is written to make the goal above true, and to never print any secret values back to you.
Paste this to Any AI tool:
In my app (the spot the scan shows): private files are being served publicly. Please make this true: Private files (.env, .git) are not downloadable from the live site, and any secret that was in an exposed .env has been rotated. Steps: Stop the host from serving the spot the scan shows (fix the host config and .gitignore, and keep it out of the deploy output); Rotate any secret that was in an exposed .env. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Lovable:
In my Lovable app (the spot the scan shows): private files are being served publicly. Please make this true: Private files (.env, .git) are not downloadable from the live site, and any secret that was in an exposed .env has been rotated. Steps: Stop the host from serving the spot the scan shows (fix the host config and .gitignore, and keep it out of the deploy output); Rotate any secret that was in an exposed .env. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Cursor:
In my codebase (the spot the scan shows): private files are being served publicly. Please make this true: Private files (.env, .git) are not downloadable from the live site, and any secret that was in an exposed .env has been rotated. Steps: Stop the host from serving the spot the scan shows (fix the host config and .gitignore, and keep it out of the deploy output); Rotate any secret that was in an exposed .env. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Claude Code:
In my codebase (the spot the scan shows): private files are being served publicly. Please make this true: Private files (.env, .git) are not downloadable from the live site, and any secret that was in an exposed .env has been rotated. Steps: Stop the host from serving the spot the scan shows (fix the host config and .gitignore, and keep it out of the deploy output); Rotate any secret that was in an exposed .env. Then tell me exactly what you changed, and do not print any secret values back to me.
Paste this to Do it myself:
Goal: Private files (.env, .git) are not downloadable from the live site, and any secret that was in an exposed .env has been rotated. Steps: Stop the host from serving the spot the scan shows (fix the host config and .gitignore, and keep it out of the deploy output); Rotate any secret that was in an exposed .env.
Then verify it worked
After the fix, xlogs re-requests the file and confirms it is no longer public.
Check your app for this issue
Free, read-only. Confirm the issue is present, then re-scan to prove your fix worked.