A sensitive developer file is publicly accessible

Developer and configuration files, such as .env files, which store passwords and API keys, .git/config, or backup copies of configuration files, are meant to stay private on the server and never be reachable by a regular visitor. This check requests these common paths directly and verifies the actual content returned, so it's not a false alarm. On this site, one such file returned real, live content to an unauthenticated request. Exposed environment and version-control files routinely contain database passwords, API keys, and payment credentials in plain text. A readable .env file or .git directory is one of the fastest routes to a complete site takeover, and automated bots continuously scan the internet for exactly these file paths, meaning this isn't a theoretical risk waiting to be discovered, it's actively being looked for right now. Your developer needs to remove public access to this file immediately, typically by fixing the web server or deployment configuration so files like .env and .git are never served to visitors, and confirm the fix by re-requesting the exact path directly. Every credential that was in the exposed file must then be treated as compromised and rotated, not just the file access itself fixed. Treat this as urgent, same-day work.