Vibe-coding patternsSeverity critical
Publicly exposed .env or .git
A .env file contains all your server secrets. An exposed .git folder lets you reconstruct the entire repository history, including old secrets already removed from the current code.
The test
curl -s https://yoursite.com/.env
curl -s https://yoursite.com/.git/configIf either response isn't a 404, it's exposed.
The fix
# nginx
location ~ /\.(env|git) {
deny all;
return 404;
}On Vercel/Netlify, the risk mostly comes from a .env committed by mistake — add .env* to your .gitignore from the moment you set up the project.
If either has already been exposed, rotate every secret it contained — not just fix the server configuration.
Full guide with per-host details and the exposed .git case:
Check whether your site is affected by this vulnerability.
Scan my app