Secrets
Exposed env files still lose keys fastest
The oldest mistakes keep appearing in the newest stacks: public .env files, forgotten backups, and source maps with secrets inside them.
· 4 min read
Every generation of tooling finds a new way to make the same old mistake. A file intended for local development ends up reachable from production. A backup archive lands in the public directory. A source map exposes an endpoint or a token hint. A framework fallback makes the result harder to interpret.
Why AI-assisted projects hit this more often
The shape of the project changes quickly. A helper suggests an .env.example, another step creates local keys, another moves assets around, and nobody performs the boring production URL check before launch.
None of those steps is wrong on its own. The failure is that no single moment in the process is responsible for asking what is now publicly reachable.
Telling a real leak from a false alarm
Single-page apps return index.html for unknown paths, so a checker that only reads status codes will report every guessed filename as exposed. That is worse than useless — a wall of false criticals teaches people to ignore the report.
A scanner should prove the path is genuinely serving non-HTML content before raising anything. And anything resembling a secret should be redacted before it is stored or displayed, because a report that quotes your key in full has just created a second copy of the problem.
If a key has been public, rotate it
Do not simply delete the file. Once a key has been reachable, the safe assumption is that it has been copied — automated scanners sweep for these paths continuously, and they are faster than you are.
Rotation is cheap. Assuming nobody noticed is the expensive option, and it is a bet you cannot verify either way.
Common questions
How do attackers find exposed .env files?
Automated scanners request a list of common paths across large ranges of hosts continuously. There is no targeting involved — being obscure is not protection, because nobody had to look for you specifically.
Is it enough to delete the exposed file?
No. If a secret was reachable, treat it as compromised and rotate it. Deleting the file closes the door but does nothing about anyone already inside.
Can source maps leak secrets?
They can expose internal endpoints, logic and occasionally embedded values. Anything compiled into a client bundle is public by definition, whether or not a source map is present.
Keep reading
The security checklist for vibe-coded websites
A practical pre-launch pass for sites built quickly with AI: the checks that catch public mistakes without turning the project into a month-long audit.
Landing pages leak more than you think
A static marketing page can still expose stack details, forgotten scripts, source maps, draft routes, and indexing mistakes.
Vibe-coded apps ship with real security debt
AI-assisted builds still need boring checks. Headers, cookies, exposed files and auth boundaries do not become optional because the first version worked.