The security gap between "it works locally" and "it's live"

Most developers treat deployment as the finish line. Code works, tests pass, push to production, done. But there's a gap between "it works locally" and "it's live on the internet" where security quietly falls apart. I built a pre-deployment scanner and over 100 developers have used it in the past few weeks. The same mistakes show up everywhere. Not sophisticated vulnerabilities - just things that got forgotten in the rush to ship. Here are the six most common ones. 1. .env files served publicly** This is the big one. Your .env file has database passwords, API keys, and secrets. Locally, it sits safely in your project root. In production, if your web server isn't configured to block it, anyone can visit yoursite.com/.env and read everything. It happens more than you think. A recent study of hackathon repos found that 17% had leaked credentials. And those are just the ones committed to git - the deployed versions are often worse. Fix: Make sure your server or hosting platform blocks requ