Matan · Security · Exposure

Exposed files

Read-only probes for /.git, /.env and similar must not return content.

Pass condition in our engine: Common sensitive paths are not publicly readable.

1. Problem description

We request a short list of well-known sensitive paths. A 200 with a body is a critical finding. This is not a full content-discovery scan and never sends payloads.

2. Most common causes

  • The site root is a git checkout.
  • .env deployed into the web root.
  • Directory listing on the server.

3. How to fix it

  1. Deny those paths at nginx/Apache/IIS.
  2. Keep git and env files outside the public directory.
  3. Rotate secrets if .env was public.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free SEO & GEO report

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Generate a free reportView sample report