Millions of IP Addresses Expose Sensitive Data via Public .env Files A major security oversight has exposed over 12 million IP addresses worldwide, leaking sensitive credentials through publicly accessible .env files, according to researchers at Mysterium VPN. The findings, reported by Security Affairs, reveal a critical lapse in operational security practices across organizations. The exposed files commonly used to store environment variables contained database passwords, API keys, JWT signing secrets, and cloud service tokens. The United States accounted for the largest share of vulnerable IPs (2.8 million), followed by Japan, Germany, India, France, and the UK. The issue stems from misconfigured servers, such as missing deny rules for hidden files, allowing direct access to credentials without requiring exploitation. Attackers could exploit this exposure to bypass authentication, access databases, forge tokens, or abuse APIs, significantly accelerating breach attempts. The incident underscores a systemic failure in secret management, with organizations often treating configuration as an afterthought rather than a security priority. Immediate remediation includes removing public access, rotating exposed credentials, and invalidating compromised tokens. Long-term fixes involve automated secret scanning, blocking hidden file access at the server/CDN level, and adopting centralized secret management with audit logs and automated rotation to prevent future breaches.