Why your Node.js API is leaking sensitive files (and how to fix it in 5 minutes)

As developers, we often focus on writing clean code, optimizing database queries, and building robust APIs. But there is one silent killer that takes down hundreds of production environments every day: exposing sensitive files in the public root directory.

I've seen this in Node.js projects, PHP, and static sites deployed to the cloud. You think your .env, your .git folder, or your database dumps are safe... until someone runs a simple curl command and downloads your entire infrastructure.

Let's see how this happens, and how to test your own site in less than 5 minutes.

The Silent Threat: Public Folders

If your web server or CDN is misconfigured, a malicious user can try to access common paths like:

• https://yourdomain.com/.env
• https://yourdomain.com/.git/HEAD
• https://yourdomain.com/backup.zip
• https://yourdomain.com/db.sql

If the server returns 200 OK instead of 403 Forbidden or 404 Not Found, you have a critical vulnerability. Your database credentials, API keys, and source code are publicly available.

How to check if you are exposed (Right Now)

Open your terminal and run this simple curl command against your own domain:

bash
curl -I https://yourdomain.com/.env
Look at the HTTP status code:

If you see HTTP/1.1 200 OK: Panic. Your .env file is exposed. Fix it immediately.

If you see HTTP/1.1 403 Forbidden or HTTP/1.1 404 Not Found: You are safe.

How to fix it (Nginx/Apache)
If you are using Nginx, add this block to your server configuration:

nginx
location ~ /\.(env|git|svn|htaccess|htpasswd) {
    deny all;
    return 404;
}

location ~ \.(bak|old|sql|zip|tar\.gz)$ {
    deny all;
    return 404;
}
If you are on Express.js, ensure your static file middleware is not serving hidden files:

javascript
app.use(express.static('public', {
  dotfiles: 'deny',
  index: false
}));
How to automate this check
Checking this manually every time you deploy is a pain. There are tools that can automate this for you and give you a full security report.

I've been building a tool called Sealgrade that runs over 15 external security checks (including this exact file exposure test, SSL, DNS, and missing HTTP headers) and gives you a 0-100 health score. It's free to run an audit, and it gives you concrete remediation snippets like the ones above.

If you are deploying to production, it's worth a 30-second check: Audit your web here.

Stay safe out there, and keep your .env files private!