A request for /.env is a marker.

Scanners ask for files a public site should not serve. /.env and /.htaccess are the common ones. The same pass looks for a git checkout, a WordPress login, or a dumped .sql file.

On the first install Ledgesec does not block that request. The dashboard marks the path in rust, the same color on the public site and in the journal. An admin then sees the address across every edge that recorded it. A user for one site sees the marked paths for that site, without the address list.