Why it matters
Files like .env hold your passwords and API keys, and anyone who types the URL can download them. Attackers try these paths on every new site.
How to check it yourself
Visit yoursite.com/.env and yoursite.com/.git/config in a browser. You should get a 404 page. If you get a file, your secrets or your source history are downloadable by anyone.
What the fix involves
Keep dotfiles out of your public or build output folder, add a server rule that returns 404 for any path starting with a dot, and treat every secret in the exposed file as leaked.
Reference: owasp.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.