env exposure

A case where Laravel's .env was publicly readable: a shared-hosting placement mistake and how to fix it

The cause: the whole app sat under the web root; only public/ should be visible. Fix in three steps — a temporary .htaccess block, rotate keys, restructure — then prevent it with process.