Public .env files and source maps on generated apps
A 200 response on /.env is not always a leak. A production source map can still publish the original source, including secrets that were in the file.
Request /.env, /.env.local, and /.git/config on the deployed host. Many single-page hosts answer an unknown path with the app's index.html and HTTP 200. That HTML document is not your environment. Read the body. A leak looks like lines of NAME=value, not a document that starts with a doctype.
Source maps
A JavaScript file can end with a sourceMappingURL comment that points at a .map file. If that map includes sourcesContent, it contains the original source from the build, including any secret that was in the file. Next.js disables browser source maps for production builds unless productionBrowserSourceMaps is turned on. Leave it off unless you are debugging production in the browser and you have checked the maps for secrets.
Vite emits browser source maps for a production build when build.sourcemap is enabled. If a Lovable or Bolt deploy is serving .map files next to the bundles, turn that off and redeploy. If a map or an env file has already been public, rotate the secrets that were in it. The next deploy does not pull a copy out of someone else's cache, and it does not erase git history.