Why it matters
Bots request /.env and /.git/config on every site on the internet, all day. If yours answers, assume someone already has the contents.
How Patch checks
Only for sites you have proved you own. We request /.env and /.git/config and check whether the answer looks like the real file rather than your normal page. We never store what comes back.
This check only runs once you verify you own the site. Until then the report lists it under "what we couldn't check".
How to fix it
- Remove the exposed files from your web root and block dotfiles in your server or host config.
- Rotate every password and key the file contained.
- If /.git was exposed, treat your source code as public and check it for secrets.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.