HIGHIncident ResponseAug 15, 2026 · 8 min
One GET Request, One Production Backend: Anatomy of a .env Exposure
A single unauthenticated HTTP GET returned the entire production secrets bundle for a customer-facing WhatsApp lead-generation bot — database, messaging provider, voice AI, LLM proxy and webhook secrets, all served as plain text.