Hey Product Hunt 👋 I clean up hacked WordPress and PHP sites for a living, and a surprising number of breaches start with something boring: a .env file, a wp-config.php.bak or a .git folder that anyone can download straight from the browser. One exposed file can hand over database passwords, API keys and cloud credentials. So I built DotenvScan: enter a domain and it checks 17 common secret/config paths from the outside (.env and its variants, wp-config.php backups, phpinfo pages, laravel.log, .git/config, .svn, .aws/credentials, .DS_Store) and tells you which are exposed, protected or not found. A few things I cared about: • Free, no signup • Plain GET requests only, nothing intrusive • File contents and results are never shown, logged or stored • Public sites only, no internal addresses It's deliberately narrow: it doesn't test XSS, SQLi, plugins/CVEs or headers. It answers one question fast: are your secrets sitting on the open web? Would love your feedback, and tell me which paths you'd like added next!

DotenvScan

Check if your .env and secret files are publicly exposed

Check if your .env and secret files are publicly exposed