Exposed Files
appsettings.json & secrets.json: the .NET secrets you did not mean to ship
In .NET apps, configuration lives in JSON files that can hold connection strings and keys. When one ends up in a public path, it is a plain URL away.
Tag
#exposed-files
Exposed Files
Source maps in production: shipping your source code by accident
Source maps make minified code debuggable by mapping it back to the original. Ship them to production and you have effectively published your source code.
Exposed Files
Your .git folder is public — and that is a full source-code download
If /.git is reachable on your site, an attacker can rebuild your whole repository — code, history and any secrets you ever committed. Here is how to check.
Exposed Files
.env exposed: how a single file hands attackers your whole stack
The .env file holds your database URLs, API keys and tokens. It belongs on the server — but when it ships to a public folder, anyone can just download it.