Observed arrival · 2026-09-26
IsMyEnvPublic: a narrow check for exposed .env files
A defensive website check that looks for publicly accessible environment files after verifying control of the domain.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Website operators checking for exposed configuration files
- Worth noticing
- The checker says it distinguishes custom 404 pages and app fallbacks from actual configuration responses, without reporting secret values.
Field notes
The workflow starts with a domain name, then requires proof of control through a temporary DNS TXT record or a file under /.well-known. The page says the service requests four fixed environment-file paths plus a random calibration path, using the latter to distinguish real files from custom error pages or application fallbacks. It says response contents are analyzed in memory and only status, path, and confidence are reported; the sample output is illustrative.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
◎NicheUnusually specific use
ƒJavaScriptBrowser-side code central
One card from the complete issue