Sensitive Files Publicly Accessible

Common sensitive files like .env, .git, or .DS_Store are accessible on your web server. These files can expose configuration secrets, source code, or system information.

Why This Matters

Exposed .env files can leak database credentials, API keys, and other secrets. Accessible .git directories expose your entire source code history, which may contain additional secrets or vulnerabilities.

How to Fix

Framework-specific solutions and general best practices

Configure your web server to deny access to sensitive files. Add rules to block requests to dotfiles and configuration files.

Quick Reference

Severity

High Risk

sensitive_files_exposed

AI Assistant Prompt

Copy this prompt to ask an AI for help fixing this vulnerability:

Please fix the "Sensitive Files Publicly Accessible" security vulnerability in this web application.

The issue is: Common sensitive files like .env, .git, or .DS_Store are accessible on your web server. These files can expose configuration secrets, source code, or system information.

Make a plan and implement based on my project.