India's .bank.in domains kept serving .env files
A licensed payments bank and a co-operative bank were serving their production .env files directly at https://<domain>/.env — no auth, no WAF, no 403. SMTP passwords, Google API keys and full public/private key pairs, in plain text on the public web.
How it was found
Prompted by a post asking, “it shouldn't be this easy,” we ran a systematic, read-only scan across the entire .bank.in namespace on 18 August 2026.
| Metric | Value |
|---|---|
| Unique hostnames scanned | 1,393 |
| Passive probe | single GET /<path>, read-only, no follow-ups, no other paths |
| Paths probed | .env, phpinfo.php, composer.json, /actuator/env, /actuator/heapdump, Laravel logs |
| HTTP 200 for /.env | 284 hosts — but all but three were HTML soft-404s / SPA fallbacks |
| Real dotenv files | 2 banks / 3 hostnames |
The confirmed .env exposures
| Host | Bank | What was exposed |
|---|---|---|
| nsdlpayments.bank.in/.env www.nsdlpayments.bank.in/.env |
NSDL Payments Bank Ltd RBI-licensed payments bank, live since Oct 2018 |
APP_ENV=prod, Google API key, a 128-char secret key, full public/private key pair |
| bnsb.bank.in/.env | Baran Nagrik Sahakari Bank, Baran Rajasthan | SMTP mail credentials (MAIL_USERNAME, MAIL_PASSWORD, MAIL_PORT, MAIL_FROM/TO) + reCAPTCHA secret |
These are real, parseable dotenv files served as application/octet-stream with HTTP 200 — not cached pages. Only key names and lengths were logged; no credential values were stored anywhere.
The wider scan: 9 entities revealed
Beyond the two live .env leaks, the scan surfaced additional misconfigurations that were all folded into a single expanded disclosure to CERT-In — nine entities in total:
| # | Class | Entities |
|---|---|---|
| 1–2 | Production .env | NSDL Payments Bank, Baran Nagrik Sahakari Bank |
| 3 | Spring Boot Actuator (/actuator/env, /actuator/heapdump) | Yes Bank (credit-card application portal) — CRITICAL |
| 4–5 | phpinfo() | RBL Bank, Krishna District CCB |
| 6–8 | Laravel storage/logs (possible PII in stack traces) | Akhandanand Co-op Bank, Kakinada Town CCB, NAMCO Co-op Bank |
| 9 | composer.json / framework metadata | Varachha, Panchganga, ABSL Co-op Banks |
Disclosure timeline
Remediation status
| Entity | Status |
|---|---|
| NSDL Payments Bank | WAF-blocked (19 Aug) — verify origin removal recommended |
| Baran Nagrik Sahakari Bank | Remediated — .env now returns 403 (21 Aug) |
| Yes Bank / RBL / Krishna DCCB | Blocked / timeout — confirm upstream disable |
| Laravel-log + composer entities | partly open — verification pending |
Report & raw material
- Analysis narrative: “India's .bank.in Domains Are Leaking Secrets” (Projects/bank-in-research/bank-in-misconfiguration-post.md)
- Env-exposure scan record: bank_in_env_exposure.md, full results bank_in_env_scan.csv
- CERT-In reply draft with exact paths and retraction: CERT-In-reply-draft.md
Deliberately, this page and our public post do not reproduce credential values. We publish the class of exposure and the disclosure record, so the sector fixes the pattern rather than the incident.