sus.botdocs

Security finding

A configuration file, backup, source map or directory listing is open to anyone

Security Error Severity: High

Part of the audit Information exposure. Finding id: security.exposedFilesAndListings.

What it costs you

Anyone can fetch this address. This check runs on verified domains only and requests a short published list of paths.

What to do

Remove it from the web root, or stop the server answering for it.

What it checks

  • Folder contents open to visitors
  • Settings or backup files publicly reachable
  • Readable source code files published

How to fix it

Switch off directory listings

    Delete the file, and refuse .git and .env in nginx

    1. Delete [path] from the web root or move it outside it. Change every password and key it contained.
    2. The block above refuses addresses that contain /.git or /.env. It does not cover backups and dumps; those have to be deleted.

    How to check: curl -sI https://www.example.com[path] | head -n 1 (use your own host; expect 403 or 404)

    Delete the file, and refuse .git and .env in Apache

    1. Delete [path] from the web root or move it outside it. Change every password and key it contained.
    2. The block above refuses the .git folder and .env files. It does not cover backups and dumps; those have to be deleted.

    How to check: curl -sI https://www.example.com[path] | head -n 1 (use your own host; expect 403 or 404)

    Remove the file from the web root

    1. Delete [path], or move it to a folder the web server does not serve.
    2. If it held passwords, keys or customer data, change the credentials and treat the data as disclosed.
    3. Find how it got there (a deploy that copies the whole project, a backup job writing into the web root) and change that step.

    How to check: curl -sI https://www.example.com[path] | head -n 1 (use your own host; expect 403 or 404)

    Stop publishing source maps

    1. Change the build so that it does not copy .map files to the web root, or decide that the code may be public.

    How to check: curl -sI https://www.example.com[path] | head -n 1 (use your own host; expect 403 or 404)