.env and .git exposure checker
Some files are usually kept private: a .env often holds secrets, and a .git folder holds your code history. This free checker requests six such paths, tells you which answer, and grades each by what it holds.
Run the check
What this checks
It makes a read-only request for a small set of paths where sensitive files are often left, requires the response to actually look like the real file (not a catch-all page) before reporting it, and grades it by what it contains. A public .env exposes every secret in it; a public .git folder can let someone download your source history.
Why it gets missed
A misconfigured host or a deploy that ships the whole project folder can expose these. If yours are exposed, stop serving them and rotate any secret that was in the .env, because you must assume it is already compromised.
See the full step-by-step fix, with a copy-paste block for your AI tool →