Exposed .env and .git checker
Paste the public origin. The free check requests /.env, /.git/HEAD, and /.git/config and only flags a response that looks like a real file, not your app's HTML fallback.
What this check looks at
- /.env counts when it returns HTTP 200, the body is not an HTML page, and at least two lines look like NAME=value.
- /.git/HEAD counts when it looks like ref: refs/…
- /.git/config counts when it looks like a git config file.
- The same check also reads that page's JavaScript for a few obvious tokens, including a Supabase service_role key. It does not print the key.
What it does not do
- One origin, from the URL you paste. It does not walk the whole site or try backup filenames.
- A single-page app that returns index.html for unknown paths is not reported as a leaked env file.
- It does not log in, submit forms, or test Row Level Security. If a file is exposed, take it offline and rotate every secret that was in it. The check does not do that for you.