← All articles
Web Security 2026-01-26 · 5 min read

Exposed .git, .env and Backup Files: A Silent Data Leak

Some of the most damaging leaks are not sophisticated hacks — they are files that should never have been web-accessible. A .env file with database passwords and API keys, a .git directory exposing your entire source history, or a backup.zip sitting in the web root.

Why it happens

Deploying with git pull leaves the .git folder in place. Framework .env files get uploaded by accident. Admins create quick backups and forget them. Search engines and automated bots actively crawl for these paths.

How to protect yourself

  • Block access to dotfiles and sensitive extensions at the server level (deny .git, .env, .sql, .bak).
  • Keep the document root limited to public assets — deploy code outside it where possible.
  • Never store backups inside the web root.
  • Scan your own site for these paths before someone else does.

The file exposure check probes for the most commonly leaked paths and flags any that respond.

Put this into practice
Run a free, private scan — no login, nothing stored.
🛡 Web Scan 🔒 SSL/TLS 📬 MX & Email 🎣 URL Check

Related articles

Web Security What Is a Web Application Firewall (WAF) and Do You Need One? A WAF filters malicious traffic before it reaches your app. Learn what it catches, what it does not, and when it is worth it. Web Security Open Ports: What They Reveal and Which Ones to Close Every open port is a potential door. Here is how to think about port exposure and reduce your attack surface. Web Security CVEs and Outdated Software: Why Version Numbers Matter A known vulnerability in an unpatched server is the easiest way in for attackers. Here is how CVEs work and how to stay ahead.