.env File Not in .gitignore
A .gitignore that doesn't cover .env files, so the secrets in them get committed with everything else.
What this rule detects
VC014 reads your .gitignore and fires when no line mentions .env. It does not inspect API responses or logs.
Vulnerable vs. safe code
# .gitignore
node_modules
dist
.next# .gitignore
node_modules
dist
.next
.env*About A05:2021 — Security Misconfiguration
Security misconfiguration covers all the ways a correctly-coded app still ships insecurely — debug endpoints in production, permissive CORS, missing security headers, default credentials.
Impact: CORS that reflects any request's Origin while allowing credentials lets any website read your authenticated API responses. Debug mode in production leaks stack traces with file paths and library versions, helping attackers find more bugs. Missing CSP makes XSS exploitable when it would otherwise be blocked.
How to fix it: Treat configuration like code: review it, test it, lock it down before production. Use an allowlist for CORS, never `*` with credentials. Disable debug/development features in prod builds. Set the standard security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options).
Common patterns in this category:
- CORS configured with `*` origin and credentials enabled
- Debug or development middleware enabled in production
- Missing Content-Security-Policy header
- Missing Strict-Transport-Security header
- Default admin credentials left in place
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
Scan your code for VC014
Free, no signup: paste code or upload a file, or run npx xploitscan@latest scan . The free scan runs 30 core rules; paid plans run all 223.