Skip to content
IsMyENVPublic

Security

Security, scope and responsible disclosure

IsMyENVPublic is a defensive tool. This page explains what it does and doesn't do, and how to reach us about security issues.

Last updated

What the scanner does

  • It checks whether /.env, /.env.local, /.env.production and /.env.prod are publicly readable on a domain whose owner has verified control of it.
  • It sends one additional request to a random, non-existent path to recognize custom 404 pages and single-page app fallbacks.
  • It classifies each response as safe, exposed or inconclusive and returns only that classification, the path, the HTTP status and a confidence level.

What it does not do

  • No crawling, directory brute forcing, or user-defined paths
  • No subdomain enumeration and no port scanning
  • No exploitation, authentication attempts or form submissions
  • No requests to private, internal or cloud metadata addresses
  • No public list or history of checked websites

Authorization requirements

Checking for exposed configuration files on a website you are not responsible for would be reconnaissance. The check therefore only runs after you prove control of the domain with a temporary DNS TXT record or a file under /.well-known/. Tokens are random, bound to a single domain, and expire automatically. Run checks only against domains you own or are explicitly authorized to test. The terms of use apply.

No secret storage

Your secrets never leave the analysis function

At most 64 KB of each response is read into memory, analyzed for environment-file structure, and discarded. The content, key names and values are never returned to the browser, logged or written to disk. Logs contain only operational metadata such as the hostname, the result classification and timings.

Hardening

  • SSRF protection: only http/https on ports 80 and 443. IP literals, credentials in URLs, local and reserved hostnames, and every non-public IPv4 or IPv6 range (including IPv4-mapped and NAT64 forms) are rejected. Connections are pinned to the validated IP to prevent DNS rebinding, and each redirect (at most three) is validated again.
  • Resource limits: 3-second connect timeout, about 7 seconds per request, 64 KB body limit (also after decompression), limited concurrency.
  • Rate limiting per IP address, per domain and globally, for token creation, verification and checks.
  • Browser security: strict Content Security Policy with per-request nonces, HSTS, framing protection and a restrictive Permissions Policy.

Recognizing our requests

Requests from the scanner use the user agent IsMyENVPublic/1.0 (+https://ismyenvpublic.org/security). If you see them in your logs and did not start a check, someone proved control of your domain, or you are seeing a spoofed user agent. In either case, please contact us.

Responsible disclosure

If you believe you have found a security vulnerability in IsMyENVPublic, please report it privately. Include a description, the steps to reproduce it and the potential impact. Please don't access data that isn't yours, don't degrade the service for others, and give us reasonable time to fix the issue before disclosing it.

Contact: [REQUIRED: set SECURITY_CONTACT_EMAIL]. Machine-readable contact information is available in security.txt.

We acknowledge reports as quickly as possible and will credit reporters who want to be named.