Bots Scraping For Insecure Sensitive Files

While setting up a new project on a live domain, I forgot to deny .env file in nginx config after uploading the .env file. It was up for a moment and I immediately added the rule.

To be safe, I checked access logs to be safe that someone didn't download the .env file during that time (it was merely a minute) and although no one accessed /.env during that time but to my surprise, there are hundreds of requests matching …

access bots cybersecurity domain download env file files insecure live logs nginx project safe scraping sensitive