After reading your post, I thought "these things happen; they'll figure it out with experience."
Tried going to clientsite.com/api/.env on a whim, and leapt out of bed.
Tried going to clientsite.com/api/.env on a whim, and leapt out of bed.
404 - GET /admin/.git/config 404 - GET /shop/.git/config 404 - GET /beta/.git/config etc..
or adhoc backups using the current date -- stuff that you think nobody would even try.
404 - GET /2020-02-27.zip 404 - GET /backup20200227.zip 404 - GET /backup.zip etc...
No webserver should be serving .folders in it's default config.