India's .bank.in domains kept serving .env files
A licensed payments bank and a co-operative bank were serving their production .env files directly at https://<domain>/.env — no auth, no WAF, no 403. SMTP passwords, Google API keys and full public/private key pairs, in plain text on the public web.
How it was found
Prompted by a post asking, “it shouldn't be this easy,” we ran a systematic, read-only scan across the entire .bank.in namespace on 18 August 2026.
| Metric | Value |
|---|---|
| Unique hostnames scanned | 1,393 |
| Passive probe | single GET /<path>, read-only, no follow-ups, no other paths |
| Paths probed | .env, phpinfo.php, composer.json, /actuator/env, /actuator/heapdump, Laravel logs |
| HTTP 200 for /.env | 284 hosts — but all but three were HTML soft-404s / SPA fallbacks |
| Real dotenv files | 2 banks / 3 hostnames |
The confirmed .env exposures
| Host | Bank | What was exposed |
|---|---|---|
| nsdlpayments.bank.in/.env www.nsdlpayments.bank.in/.env |
NSDL Payments Bank Ltd RBI-licensed payments bank, live since Oct 2018 |
APP_ENV=prod, Google API key, a 128-char secret key, full public/private key pair |
| bnsb.bank.in/.env | Baran Nagrik Sahakari Bank, Baran Rajasthan | SMTP mail credentials (MAIL_USERNAME, MAIL_PASSWORD, MAIL_PORT, MAIL_FROM/TO) + reCAPTCHA secret |
These are real, parseable dotenv files served as application/octet-stream with HTTP 200 — not cached pages. Only key names and lengths were logged; no credential values were stored anywhere.
The wider scan: 9 entities revealed
Beyond the two live .env leaks, the scan surfaced additional misconfigurations that were all folded into a single expanded disclosure to CERT-In — nine entities in total:
| # | Class | Entities |
|---|---|---|
| 1–2 | Production .env | NSDL Payments Bank, Baran Nagrik Sahakari Bank |
| 3 | Spring Boot Actuator (/actuator/env, /actuator/heapdump) | Yes Bank (credit-card application portal) — CRITICAL |
| 4–5 | phpinfo() | RBL Bank, Krishna District CCB |
| 6–8 | Laravel storage/logs (possible PII in stack traces) | Akhandanand Co-op Bank, Kakinada Town CCB, NAMCO Co-op Bank |
| 9 | composer.json / framework metadata | Varachha, Panchganga, ABSL Co-op Banks |
Disclosure timeline
Reports filed — 14–28 Aug 2026
Three separate disclosures went to CERT-In in the last fortnight, plus direct notifications to affected entities. CERT-In registered and actioned each; references are quoted from their PGP-signed replies.
| Report | Filed | CERT-In reference |
|---|---|---|
| Publicly accessible .env files — NSDL Payments Bank, Baran Nagrik Sahakari Bank | 18 Aug | CERTIn-49794926, CERTIn-19257826 |
| Expanded .bank.in exposures — 9 entities (classes as tabled above; exact paths shared with CERT-In, withheld here for unfixed items) | 18 Aug | CERTIn-26992926 (Yes Bank) + per-entity refs |
| Follow-up: .env on a co-operative-bank complaint portal (registry records the registrant as a small-finance bank; CERT-In advises the host does not pertain to that bank — operator still unattributed) | 21 Aug | same thread |
Re-check — 28 Aug 2026
Ten days after the expanded report, we re-probed every reported path with the same read-only method. Detail below is limited to the .env exposures; for the other classes we state only entity + class + status.
| Entity | Class | 19 Aug (reported) | 28 Aug (re-check) |
|---|---|---|---|
| Baran Nagrik Sahakari Bank | .env | live (206) | Fixed — 403; CERT-In confirmed closure 21 Aug |
| NSDL Payments Bank (both hostnames) | .env | WAF page | Blocked — application page served, no dotenv; origin removal still to be confirmed |
| Co-op complaint portal (operator unattributed) | .env | live | Still open — full production dotenv (35 keys incl. cloud + DB credentials) served, 1,539 bytes |
| Yes Bank | Spring Actuator | host unreachable | Unreachable — unchanged; removal unverified |
| RBL Bank | phpinfo() | WAF denial | Removed — 404 |
| Krishna DCCB | phpinfo() | WAF | Removed — 404 |
| Akhandanand Co-op Bank | Laravel log | open | Still open |
| Kakinada Town CCB | Laravel log + composer.json | open | Still open — log now ~4.4 MB |
| NAMCO Co-op Bank | Laravel log | open | Still open — log now ~12.6 MB |
| Varachha Co-op Bank | composer.json | open | Changed — path now returns the site's HTML app page |
| Panchganga Co-op Bank | composer.json | open | Removed — 404 |
| ABSL Co-op Bank (webmail host) | composer.json | open | Host unreachable — unverified |
Score at ten days: 3 confirmed fixed (Baran, RBL, Krishna DCCB), 1 blocked pending origin (NSDL), 3 still open (the unattributed complaint-portal .env plus co-operative-bank log/metadata exposures), 2 unverifiable (unreachable hosts), 1 changed. The still-open .env is the most serious remaining item: a production Laravel environment with cloud and database credentials, on a host whose operator CERT-In says is not the bank the domain name suggests.
Earlier remediation status
| Entity | Status |
|---|---|
| NSDL Payments Bank | WAF-blocked (19 Aug) — verify origin removal recommended |
| Baran Nagrik Sahakari Bank | Remediated — .env now returns 403 (21 Aug) |
| Yes Bank / RBL / Krishna DCCB | Blocked / timeout — confirm upstream disable |
| Laravel-log + composer entities | partly open — verification pending |
Report & raw material
- Analysis narrative: “India's .bank.in Domains Are Leaking Secrets” (Projects/bank-in-research/bank-in-misconfiguration-post.md)
- Env-exposure scan record: bank_in_env_exposure.md, full results bank_in_env_scan.csv
- CERT-In reply draft with exact paths and retraction: CERT-In-reply-draft.md
Deliberately, this page and our public post do not reproduce credential values. We publish the class of exposure and the disclosure record, so the sector fixes the pattern rather than the incident.