Your .DS_Store file leaks your folder structure to anyone
A housekeeping file with a loose mouth
If you work on a Mac, every folder you open quietly gets a hidden .DS_Store file. It stores boring things — icon positions, window size, view preferences. You have never opened one and you never need to. The problem is not what it does on your machine. It is what it reveals when it accidentally rides along to a public web server.
What it actually exposes
A .DS_Store file does not just hold view settings — it also contains a list of the file and folder names that were in that directory when macOS last touched it. Parsed back out, that list is a map of your project's structure.
That map can include:
- The names of folders you never linked to —
admin,backup,staging,old. - Filenames that hint at what is there —
config.bak,database_dump.sql,notes-internal.txt. - The general shape of how your site is organised, which makes guessing other paths much easier.
None of this is a breach on its own. But it is reconnaissance handed over for free: an attacker no longer has to guess your layout, because you published the index.
Why it ends up public
The mechanism is dull and entirely accidental. You build your site in a folder on your Mac, macOS sprinkles .DS_Store files through it, and then you deploy the whole folder — drag-and-drop upload, an rsync, a build step that copies everything. The hidden files come along because nothing told them not to. It is normal hygiene that simply got skipped, not a sign anyone did anything reckless.
It is also predictable. Bots specifically request /.DS_Store on sites because it is so commonly left behind, so a stray one tends to be found quickly. The same goes for Windows Thumbs.db files and editor folders — anything your operating system or tools scatter around your project can hitch a ride to production the same way.
How to remove and prevent it
- Delete the deployed ones. Find and remove any
.DS_Storefiles already on your server or in your published build output. - Block them at the server. Configure your web server or CDN to refuse requests for
.DS_Store(and other dotfiles) so even a stray one cannot be downloaded. - Ignore them in Git. Add
.DS_Storeto your.gitignoreso they never get committed, and clean any that already were. - Exclude them from deploys. If your deploy copies a folder, add an exclude pattern so hidden files do not ship.
The same logic covers siblings worth checking for: .git/ folders, .env files, editor backups and source maps that ended up in a public path.
Check what is reachable
You will not notice a .DS_Store because nothing on your site links to it — it just sits there for anyone who asks. An automated scan probes for these commonly-exposed files the way a bot would and tells you what is reachable. Scan your site and see what is exposed.