Identify the active document root and every place the application loads secrets. Check backups, old environment files and deployment archives as well as the current configuration file.

1. Move secrets into the hosting platform’s protected environment or an appropriately permissioned private configuration location supported by the application.

2. Keep the web document root limited to the framework’s public entry files and assets. Update application paths through the supported deployment configuration.

3. Remove public backup copies, editor leftovers and old archives containing credentials after securing a proper private recovery copy.

4. Test direct requests for likely configuration paths and confirm they do not disclose contents. Use server access rules as an additional control where appropriate.

5. If a secret was exposed, rotate it and review access. Moving the file does not invalidate copies already obtained.

Confirm the app still starts and that ordinary visitors cannot retrieve configuration or backup files. Check the final release artifact and future deployment process for recurrence.

Identify every process that uses the secret before changing it. A website, queue worker and scheduled task may run under separate environment configurations even though they belong to one application.

1. Create or obtain the replacement secret through the provider's approved process.
2. Update the intended production secret store or environment setting without committing the value to Git.
3. Restart or reload the relevant processes as required by the application's deployment model.
4. Test a safe operation and confirm the replacement works before retiring the old value, where the provider supports that sequence.

Can I check the value by printing the whole environment?

Avoid exposing all environment variables in a browser response or support ticket. Test whether the required setting is present without printing the secret itself. Remove temporary diagnostic code immediately after use.

If the value was already exposed, treat removal and rotation as separate tasks. Deleting one file or log entry does not make a copied credential safe again. Tell us the hosting capability you need and the relevant redacted error when requesting help. Keep the actual credential in your approved private storage.

A denied current .env file does not prove an old archive or alternate filename is protected. Review the full public directory rather than testing one path only.

• Protecting production secrets in CI jobs
• Removing credentials accidentally committed to Git
• Keeping browser bundles free of private API credentials
• Checking the PHP runtime used by Composer

• OWASP secrets management
• Laravel public document root