Environment File with Credentials Exposed via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects HTTP requests for the '.env' file, which often contains sensitive environment variables and credentials. An attacker successfully retrieving this file could gain access to critical system information, API keys, database credentials, and other secrets, leading to further compromise. The rule specifically looks for the string '/.env' in the HTTP URI, indicating an attempt to access this configuration file.