#exposed-files

Exposed Files

phpinfo() and server-status: the debug pages attackers grep for

A forgotten phpinfo.php or an open server-status page is a free reconnaissance gift. Bots request them by name on every site. Here is what they reveal and how to close them.

Exposed Files

Your .DS_Store file leaks your folder structure to anyone

It is a tiny macOS housekeeping file you have never opened. Deployed to a web server, it quietly hands visitors a map of your folders.

Exposed Files

appsettings.json & secrets.json: the .NET secrets you did not mean to ship

In .NET apps, configuration lives in JSON files that can hold connection strings and keys. When one ends up in a public path, it is a plain URL away.

Exposed Files

Source maps in production: shipping your source code by accident

Source maps make minified code debuggable by mapping it back to the original. Ship them to production and you have effectively published your source code.

Exposed Files

Your .git folder is public — and that is a full source-code download

If /.git is reachable on your site, an attacker can rebuild your whole repository — code, history and any secrets you ever committed. Here is how to check.

Exposed Files

.env exposed: how a single file hands attackers your whole stack

The .env file holds your database URLs, API keys and tokens. It belongs on the server — but when it ships to a public folder, anyone can just download it.