Fix · Express / Node

Fix “Exposed .env file” on Express / Node

Remove .env from the web root, block dotfiles at the server, and ROTATE every secret that was exposed -- assume it is compromised.

app.use((req, res, next) => {
  if (/\/\.(?!well-known)/.test(req.path)) return res.sendStatus(403);
  next();
});  // and keep .env OUT of any static root

Verify the fix

Re-run the Exposed .env file check after deploying. Test config changes in staging first and keep a rollback: a wrong header can break a site faster than a missing one.

Other stacks: nginx · Apache · Caddy · Cloudflare

Scan your site free → Monitor it continuously