Exactly. You could access to it like viralquotesonline.com/.env. I did several mistakes for sure. It was my first project launched to the world and the first time I used Laravel, is a bit embarrassing to be honest, but hopefully helps other to realize that they are in a risk too.

What I don't get is how the .env file was even served when Laravel uses the public/index.php as starting point, so your root Folder should have been the public/ folder, not the application folder.

Mistakes like this happen, but it takes courage to post about it. Thanks for sharing it.

I'm not totally sure I'm not a Laravel expert I just use it as a backend api so I believe I exposing the entire Laravel folder instead just the public. And yes is embarrassing haha.

I was curious too how this could happen, since the .env wouldn't normally be in the public folder.

Laravel is a great framework, check out Laracasts.com and forge.laravel.com, it's a deployment tool that will spin up a VPS on AWS, Digital Ocean, etc. with the proper configuration.

But how did that work in the first place? Not that it is good practice etc however, normally your webserver for Laravel would be pointing to $MYSITE_DIR/public and .env would be $MYSITE_DIR/.env. So how did you end up getting it exposed there?

Well it’s a good lesson and definitely don’t pay them. but I’m still not sure how they accessed the DB. Did you expose port 3306 over a public IP?

Small things like this are one of the reasons I founded the PHP hosting platform, Amezmo where secure production ready container instances can be launched in seconds.

>And if you call in the next twenty minutes...