Security Help

[PeopleInside]

Hi, I need comunicate to you in private for a security issue.
Where I can email you?
I hope to hear you soon and to fix the security issue.
Thank you

Marco

[Bubka]

Hi Marco,

Please find my email address here: https://docs.2fauth.app/support/bug-reporting/#contact

[PeopleInside]

Thank you!
Some errors has been added on my server and what I think was an automatic scanner found that was able to access my .env file.
My app database and email was exposed and a spam start to be sent from my emails because I get not authorized access.

This issue burn when I try to bypass the certificate renewal issue that was not able to verify using the acme file verification.
Now I have made a full backup, resetted the APP KeY so loosed the account and all Key, reset and I'm generating all new two factor code. I have about 50 account to secure.

Also for email intrusion I taken the necessary actions: change DNS, DKIM and password.
Now I have setup the server to be protected to point on the public folder.

I will also see if I can install some bot software that will monitor file permissions and issues like this.
This app is the only app I'm using at the moment that have .env file to memorize access. In the past I was using other laravel apps that store credentials on that.