Checks · PORT-003

PORT-003 · .git or .env served over HTTP

Why it matters

If the server returns your .git directory or .env file, the source and keys are public.

How we detect it

A read-only request to /.git/HEAD or /.env returns the file rather than a page.

How we fix it

Block those paths in the server or host config.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-002 · Secret in git history
• SEC-003 · Service-role or secret key in client bundle
• SEC-004 · Public env prefix on a secret