title: Do these .env GET requests from localhost indicate an attack?
body: <p>I was just looking through our logs after getting some intermittent 5xx errors on a Heroku hosted site, and in there I discovered many errors that were emanating from localhost and were requests for hidden files, usually .env but also things like stuff like &quot;.well-known/assetlinks.json&quot; and occasionally .env in non-existant subfolders.</p>
  <p>The requests are not frequent (15 - 30 per day), but appear to have been going on for a week. They are also being met with a &quot;access forbidden by rule&quot; which as far as I can tell is nginx.</p>
  <p>The request look similar to:</p>
  <p>2020/09/28 14:37:44 [error] 160#0: *1928 access forbidden by rule, client: 10.45.153.152, server: localhost, request: &quot;GET /.env HTTP/1.1&quot;, host: REMOVED</p>
  <p>I don't have any ENV files on the server, and the nginx seems to be blocking the requests, so it doesn't feel like there is any harm. Restarting all the dynos seemed to have killed the activity (based on a few hours having passed), but what worries me is that these appear to be &quot;coming from inside the house&quot;. Is there something here that I should be concerned about? Is this a case of a bot exploiting a bug in a system that has local access?</p>