Bolt
Exposed .env files on a Bolt app
Bolt serves a live preview from the project you are editing. That preview is a public address. Code that looks private in the editor is still in the script the preview downloads.
Public env files and why source maps are a separate problem.
What the scan can see
One GET each for /.env, /.env.local, and /.env.production. A body that looks like assignment lines is a critical finding. An HTML app shell at those paths is not treated as a leaked env file. /.git/HEAD and /.git/config are checked the same way.
What it does not do
Source maps (.js.map) are not requested. A map file can reveal original source, and this scan will not tell you if one is public. Local env files that were never deployed are also invisible.
The scan does not sign into Bolt or read the editor. It only requests the URL you paste and a short, fixed list of paths on that host.
What to do next
If an env file was public, rotate every secret that was in it. Configure the host so those paths 404. Do not publish source maps for a production bundle.
Questions
Does this open my Bolt project?
No. The scan does not sign into Bolt or read the editor. It only requests the URL you paste and a short, fixed list of paths on that host.
Can the scan prove exposed .env files is fully fixed?
Source maps (.js.map) are not requested. A map file can reveal original source, and this scan will not tell you if one is public. Local env files that were never deployed are also invisible.
What should I do if the scan finds it?
If an env file was public, rotate every secret that was in it. Configure the host so those paths 404. Do not publish source maps for a production bundle.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.