Skip to content
StackSiren
Free scan

Exposed .env, .git and source map checker

A deploy that uploads the whole project folder can make your .env file, your git history or your original source code public. Enter your URL to check the usual paths. We never display the values.

Passive, read-only check. No signup, no email needed.

What this checks

  • /.env served as a plain-text file with variables in it
  • /.git/config readable (often means the whole repository can be downloaded)
  • JavaScript source maps (.map) that expose your original source code

How it works (and what it never does)

  • We request /.env and /.git/config once each, without following redirects to other sites.
  • We check the sourceMappingURL of up to 12 same-origin scripts and fetch at most 3 maps (first 64 KB only).
  • We only count variables. The contents are never shown, stored or sent.

Fix guides

FAQ

My .env file is exposed. What now?

Rotate every secret in it straight away, then stop the file being deployed: add it to .gitignore and the platform's ignore list, and block dotfiles at the web server or CDN.

Are source maps a security risk?

They don't leak secrets on their own, but they publish your original, readable source code, which makes it much easier to find bugs and hard-coded values. Disable them in production builds unless you upload them privately to an error tracker.

Why does my site return a page for /.env but the check passes?

Many single-page apps return index.html for every path. We only flag /.env when it looks like a real env file with variable assignments.

Is checking for /.env legal?

It's a single ordinary GET request for a public URL. Only check sites you own or have permission to test, which the form asks you to confirm.

More free tools