Created Linkedin account while I had a job, kept it passive for a while - 6 months. Became active when I quit, recruiters started contacting me. Got a new job, during covid and only because of Linkedin, in 2-3 months.

Exactly. Nginx/apache is not pointing to /public/ directory as root of the application/domain. That's why .env is accessible.

Laravel should/does have it on ignore by default.

Github offers free private repos as well

Bitbucket has been offering that for years