Common · Laravel and others
Exposed .env files and debug mode
Config files and debug pages can hand over passwords and keys. In Laravel, a debug page left on in production was exploitable for remote code execution (CVE-2021-3129).
Why it matters to you
A `.env` file holds database passwords, API keys and the app key. If the web server is set up so that file can be downloaded, everything in it is exposed. Debug pages show the same secrets in a friendlier format.
Check it yourself
- 01On your own site, open
yourdomain.com/.envandyourdomain.com/.git/config. You should get a 403 or 404, not a file. - 02Confirm debug is off in production:
APP_DEBUG=falsein Laravel,WP_DEBUGoff in WordPress. - 03Confirm the web server’s document root is the
publicfolder, not the project root.
Fix it
- 01Turn debug off in production.
- 02Point the document root at the public folder and block dotfiles in the web server configuration.
- 03If a file was exposed, rotate every secret in it: database password, API keys and the app key.
- 04Delete old backups, archives and
.gitfolders from the web root.
How PatchRig helps
PatchRig checks for exposed files and debug settings, fixes the server configuration on a copy, and rotates secrets if anything was exposed.