The service reads its configuration from an environment file. That file is sitting in the web root.
Hint (nudge only): Dotfiles are hidden on a filesystem, not on a web server. Try the filename a 12-factor app loads its secrets from.