Exposed Files & Git Leak Scanner
Check whether sensitive files like .env, .git/config, or database backups are publicly accessible on your site.
Sign in to run this scan
Free to use — we just ask you to sign in so scans stay fair for everyone.
How it works
This scanner requests a known list of commonly forgotten paths — .env, .git/config, backup archives, config files — and flags any that return a real response instead of a 404. Deploy scripts and CI pipelines leave these behind more often than most site owners realize.
A leaked .env file alone can expose database credentials, API keys, and secret tokens — enough for a full compromise without ever touching your login page.
Frequently asked questions
It found nothing — does that guarantee no files are exposed?
No — it checks a known list of commonly-forgotten paths, not every possible file on the server. A clean result is a good sign but not an exhaustive guarantee for unusual or custom file paths.
I found an exposed .env file — what's the very first thing to do?
Rotate every credential in that file immediately (database passwords, API keys, secret tokens) — don't just remove public access to the file, since there's no reliable way to know if it was already found and copied.
Is checking for these files itself risky or intrusive?
No — it only sends standard GET requests to check if a file exists and is publicly readable, the same as a browser visiting the URL directly. It doesn't attempt to exploit anything it finds.
Related tools
Malware & Blacklist Checker
Detect malware, phishing & blacklist status across 70+ vendors.
IP Reputation Checker
Check IP or domain reputation, ASN and geolocation.
Phishing & Typosquatting Detector
Find lookalike domains that could impersonate your brand.
IP Blacklist (DNSBL) Checker
Check if an IP/domain is listed on Spamhaus, SpamCop & other blacklists.