1.What happened on our first day
Our site, lidtight.com, went live on 1 November 2026. We turned on its access logs (a line for each request the site gets) 7.2 hours later. The table counts break-in requests: requests for a secret file or for a known break-in page. Times are UTC.
| When | What we saw |
|---|---|
| 1 Nov, 11:38 | lidtight.com goes live |
| 1 Nov, 18:52 | Our access logs start (7.2 hours after launch) |
| 1 Nov, 21:42 | The first break-in request in the logs (10.1 hours after launch) |
| 2 Nov, 11:38 | 24 hours after launch: 1,526 break-in requests from 82 addresses |
| 2 Nov, 17:38 | 30 hours after launch: 2,254 break-in requests from 92 addresses |
| 2 Nov, 17:49 | When we read the logs (30.2 hours after launch): 2,575 break-in requests from 93 addresses |
Not one request got a file. Every answer was “not found” (404), a move from http to https (301), or one error (503). Our site has no secret files to give.
Most of these bots hide what they are. 2,281 of the 2,575 requests used the user agent (the name a browser sends) of a normal browser, not a bot name.
2.What the bots asked for
These are the paths the bots asked for most often, in all the logs:
| Path | Requests | What it is |
|---|---|---|
| /.git/config | 30 | A file in the .git folder. When this folder is public, anyone can download your full code history, with keys you deleted later. |
| /.env | 23 | A settings file. It often holds passwords and secret keys. |
| /info.php and /phpinfo.php | 16 each | Pages that call PHP’s phpinfo, which shows the server’s setup. |
| /.env.production, /.env.local, /.env.prod | 15, 14, 14 | Other names for the same settings file. |
| /.env.backup, /.env.bak, /.env.dev | 13 each | Copies of the settings file that people forget to delete. |
Our site does not use PHP or WordPress. The bots did not check first: they asked for PHP pages on a site that has none.
3.How bots find a new app so fast
We do not know how each bot found us. No request in the logs came from a link on another site.
One public list is enough. When a site gets an HTTPS certificate, the certificate goes into public certificate logs, and “anyone can query them to see what certificates have been included and when” (Certificate Transparency: How CT works). Our certificate is in these logs: it carries their receipts.
4.Check your own app in two minutes
- Open your app’s address with /.env at the end, for example https://your-app.com/.env, in your browser.
- If you see your app’s normal page or a “not found” page, the file is not public. Some apps show their home page for any address they do not know. That is fine.
- If you see lines like NAME=value, the file is public. Remove it from your site. Then change every key and password in it: a bot may already have a copy.
- Do the same with /.git/config. If you see a line that says [core], your code history is public.
LidTight’s free check tries 16 of these files for you, with the rest of what a stranger can see in your app.
5.How we counted
- We read the site’s access logs from 1 Nov, 18:52 to 2 Nov, 17:49 UTC: 4,172 requests in all.
- A break-in request asks for a secret file (.env, .git, database backups) or a known break-in page of other software (PHP, WordPress and others).
- We left out our own requests: 115, from our own two addresses. Our own scanner names itself in every request, and none of the requests in the logs came from it.
- Our logs start 7.2 hours after launch, so the real numbers are higher.
- A request on http:// gets a move to https://, and the bot often asks again there. So some tries count twice: 836 of the 2,575 requests were such moves.