env
3 articles with this tag
What is .env — what happens when an environment file leaks
.env holds an app's secrets (DB auth, API keys, encryption keys). Because the keys are gathered in one file, exposure leaks every secret at once. Keep the app outside the docroot, never commit it to git, and rotate everything if it leaks.
Security basics: what's actually dangerous about .env and API keys
Start here. Understand what happens when .env and API keys leak (someone uses the service as you, and you get billed for it), then adopt four habits today: don't expose them, don't commit them, rotate everything if leaked, and self-check.
Keeping .env off the public web on shared hosting
The main fix: app body outside the docroot, only public/ exposed. Block access with .htaccess first, make it permanent by restructuring, then self-check. This site's view: this isn't one person's slip but a dangerous layout that became standard across the industry — fix it with process, not vigilance. bootstrap-redirect beats symlink.