# How to protect .env, .git and other sensitive files

> Configuration and repository files left readable expose passwords and source code. Block them at the web server.

Security · HTML version: https://getreport.app/learn/exposed-files

## Exposed .env and .git files

Passing looks like: No sensitive files are readable.

**Why it matters.** /.env holds database passwords and API keys; /.git exposes your source code and every secret ever committed. Both are the first things an automated scanner asks for.

**How to fix it.**

1. Block dotfiles at the web server (nginx: location ~ /\. { deny all; }; Apache: RedirectMatch 404 /\..*$).
2. Move .env outside the web root and rotate every credential in it; assume the file has already been copied.

Check your own page: https://getreport.app/