It's disappointing how many apps fail the basic vibe-coded test. If you've made a web app, and I can access .env directly from the browser, you have failed at all the things. I've found this twice in three months. This should be happening, like, maybe once. In my entire life. For bonus points, also don't put your .env file on github.