From Dev.to
Block .env and config-file probes in Express and Fastify
Open the 404 log of any public API and you will find requests for files that were never meant to be served: /.env, /.git/config, /.aws/credentials. The list has grown. Scanners now ask for the config...