But how did that work in the first place? Not that it is good practice etc however, normally your webserver for Laravel would be pointing to $MYSITE_DIR/public

But how did that work in the first place? Not that it is good practice etc however, normally your webserver for Laravel would be pointing to $MYSITE_DIR/public and .env would be $MYSITE_DIR/.env. So how did you end up getting it exposed there?