I was curious too how this could happen, since the .env wouldn't normally be in the public folder.

Laravel is a great framework, check out Laracasts.com and forge.laravel.com, it's a deployment tool that will spin up a VPS on AWS, Digital Ocean, etc. with the proper configuration.