Exposed files

Files that belong on a developer machine sometimes end up in the public folder of a site.

What it is

Deploys copy a folder to the web. When that folder holds a .env file, a .git directory, a database dump, a backup archive, a log, a Terraform state or a key file, the web server serves them like any image.

Why it matters

These files hold what the app runs on: passwords, tokens, the whole source history, customer data. A bot that requests /.env on every site finds them within hours of a deploy. Tenty rates the finding critical or high when the file holds secrets or data, and lower for files that only name services.

How Tenty checks it

Tenty asks for about 105 known paths one at a time with a pause between requests, and compares each answer with the answer to a made up path, so a single page app that returns its shell for every address gives no false hit. Every answer must also look like the file: a .env needs variable lines, a dump needs SQL, an archive needs its file signature. This runs for verified owners only. The finding names the file and never copies its content.

How to fix it

1. Remove the file from the public folder and redeploy. 2. Rotate every credential the file held, since it was public while it was there. 3. Add the file to .gitignore and to your build's exclude list. 4. For .git and similar folders, deploy only the built output folder. 5. For data stores such as Elasticsearch and CouchDB, close the port to the internet and require a login.

How to reproduce

curl -sSI 'https://YOUR-APP/.env'

Use the path from the finding. A 200 answer with file content means it is public.