Why this matters for PCI DSS
A leaked .env file usually contains: database password, payment gateway API keys, session encryption secret, mail credentials, and OAuth client secrets. Any one of those is a complete compromise.
An exposed /.git directory lets an attacker run git-dumper and reconstruct your entire source repository — including any committed-then-removed credentials in history.
PCI DSS 4.0 Requirement 6.4.3 covers payment-page integrity. Requirement 8.3.1 requires strong authentication factors. Requirement 3.5.1 requires that cryptographic keys be protected. Leaking config files breaks all three at once.
How to fix it
1. Move secrets out of the document root. Best practice: read secrets from environment variables (set by your process supervisor — systemd, supervisord, IIS app pool identity), not files inside the web root.
2. Block hidden files at the web server.
nginx:
location ~ /\.(?!well-known) {
deny all;
return 404;
}
location ~ \.(sql|bak|zip|tar|gz|env)$ {
deny all;
return 404;
}
Apache:
<FilesMatch "^\.">
Require all denied
</FilesMatch>
<FilesMatch "\.(sql|bak|zip|env)$">
Require all denied
</FilesMatch>
IIS — add to web.config:
<system.webServer>
<security>
<requestFiltering>
<hiddenSegments><add segment=".git" /><add segment=".env" /></hiddenSegments>
<fileExtensions><add fileExtension=".sql" allowed="false" /><add fileExtension=".bak" allowed="false" /></fileExtensions>
</requestFiltering>
</security>
</system.webServer>
3. Rotate any credentials that were in a leaked file. Assume the file was downloaded the moment it became reachable.
4. Delete the debug pages. phpinfo.php has no place on a production server.
5. Add to your CI: a deploy script that refuses to publish if it finds .env, .git, or .sql files in the upload payload.