Private files are being served publicly
Some files should never be reachable from your live site: .env holds your secrets, and the .git folder holds your entire code history. A misconfigured host or a bad deploy can serve them publicly. Here is what it means, why it happens, and how to fix it, including the step people forget.
What it means
A file that should never be public — like your .env (which holds secrets) or your .git folder (your whole code history) — is downloadable from your live site.
Why AI tools cause it
A misconfigured host or a bad deploy can expose these. AI setups sometimes deploy the whole project folder, including files that should be ignored.
How xlogs checks it
xlogs makes a read-only request for a small set of files that must never be public (.env, .git/config).
Check your own app for this
How to fix it
The goal: Private files (.env, .git) are not downloadable from the live site, and any secret that was in an exposed .env has been rotated.
- Stop the host from serving the affected spot (fix the host config and .gitignore, and keep it out of the deploy output)
- Rotate any secret that was in an exposed .env
In my app (the spot the scan shows): private files are being served publicly. Please make this true: Private files (.env, .git) are not downloadable from the live site, and any secret that was in an exposed .env has been rotated. Steps: Stop the host from serving the spot the scan shows (fix the host config and .gitignore, and keep it out of the deploy output); Rotate any secret that was in an exposed .env. Then tell me exactly what you changed, and do not print any secret values back to me.
Then verify: After the fix, xlogs re-requests the file and confirms it is no longer public.
Full step-by-step fix guide, with a copy-paste block for each AI tool →
Common questions
How serious is an exposed .env or .git folder?
An exposed .env or .git folder is critical. A public .env hands over every secret in it. A public .git folder lets someone download your whole source history, including secrets you committed and later removed. Both require no hacking, just a direct request.
I stopped serving the file. Am I done?
Not quite. If a .env was exposed, assume every secret in it is compromised and rotate them (regenerate them at each provider). Removing the file stops new leaks; rotating the keys closes the ones that already leaked. Then re-scan to confirm the file is no longer public.