The files you forgot you deployed
The .env, the backup, the .git folder anyone can download with a URL.
Every guide in this topic
Can anyone download your .env file? (Type the URL and find out)
A public .env hands a stranger your database password, API keys, and secrets in one request. How it leaks, how to check, and how to shut it.
Is your .git folder public? Strangers can rebuild your source from it
A public .git directory lets anyone clone your full source history, secrets and all. How it leaks, what attackers pull, and the one-line fix.
Why a leftover backup.sql is the worst file on your server
A forgotten backup.sql in your web root is every customer record in one download. Why it happens, what's in it, and how to find it before a bot does.
WordPress backup and config files attackers check first
Bots hit wp-config.php.bak and debug.log minutes after a WordPress site goes live. What those files leak and how to lock them down.
Is your directory listing turned on without you knowing?
An open /uploads/ index lists every file you never linked. Why directory listing turns on by accident and how to check it from outside.
Your S3 bucket says "public." Did you mean that?
Public on an S3 bucket can mean publicly listable, file by file. What ListBucket exposes, why it happens, and how to check from outside.
Spring Boot Actuator: the /actuator endpoints that dump your secrets
An exposed /actuator/env or /heapdump on a Spring Boot app hands a stranger your config and a memory dump full of live keys. What each endpoint leaks, and how to lock it.
terraform.tfstate, .aws/credentials, sftp.json: the infra files in your web root
A public terraform.tfstate or .aws/credentials hands a stranger your whole cloud. The deploy and infra config files that end up downloadable, and how to check.
Is your SSH private key downloadable from your own website?
A public id_rsa or .htpasswd file is a direct login to your server. How private keys end up in the web root, what a stranger does with one, and how to check in seconds.
phpinfo.php, server-status, .DS_Store: the small leaks that map your server
A public phpinfo.php or /server-status hands an attacker a full map of your stack. The low-severity files that add up to reconnaissance, and how to find them.
A public .svn folder rebuilds your source the same way a .git one does
Subversion leaves a .svn directory that exposes your source history just like .git. How a public .svn/wc.db lets a stranger reconstruct your code, and the fix.
Is your TLS private key downloadable? (It's the one file that undoes HTTPS)
A public server.key or privkey.pem hands a stranger the private half of your TLS certificate, the secret that proves a server is really you. How it leaks, what it lets an attacker do, and how to check.
nginx.conf, .user.ini, authorized_keys: the config files that map your server for free
Web-server configs, PHP runtime files, IDE datasource configs, and SSH key lists don't hold passwords, but downloadable they hand an attacker your internal layout. The low-severity files that add up to a map.
Your Next.js or Cloudflare Pages build output is leaking secrets it was never meant to serve
A mis-served .next manifest hands over your env block and a key to forge preview cookies. A _worker.js.map de-minifies your server code. A _redirects file can hide an API key in plain sight. The modern-framework build leaks, explained.
A downloadable keystore.jks or site-backup.zip is your whole app in one file
A Java keystore holds the private keys for your TLS and signing. A backup archive is the entire site, source and secrets, zipped. Both end up downloadable, and both are found by their first few bytes, not their name.
A FileZilla password isn't encrypted, it's base64. And it might be in your web root.
FileZilla, Composer, Tomcat, Symfony, Magento, and SFTP configs all store a host plus a password. Downloadable, each one is a login a stranger can read. The credential-bearing config files that aren't your .env.
Your whole mailbox in one downloadable file
A public .mbox archive is every email you ever sent or received in one download: reset links that may still work, OTPs, invoices, customer PII. How it ends up in the web root, and how to check.
The swap file, the SQLite db, and the Redis dump your app left in the web root
A .swp swap file is the full plaintext of whatever was being edited. A SQLite db or a Redis dump is your whole datastore in one download. All three are caught by their magic bytes, not their name.
Your deploy tool wrote your secrets to a file, then you shipped the file
serverless deploy resolves your secrets into a CloudFormation template. CDK writes your whole infra topology to cdk.out. git.properties can carry a repo URL with credentials. The deploy artifacts that leak, and how to check.
A Kubernetes Secret isn't encrypted. It's base64. And yours might be in the web root.
A secret.yaml served from your web root leaks every value in it, because Kubernetes Secrets are base64-encoded, not encrypted. What a downloadable Secret manifest hands over, and how to check.
Your Ansible inventory lists every server you run, and the passwords to log into them
A public group_vars or vault.yml leaks the credentials Ansible uses to log into your whole fleet, in plaintext if it isn't vaulted. What an exposed inventory hands an attacker, and how to check.
Is your Django settings.py being served as source? SECRET_KEY signs every session you issue.
When a misconfigured docroot serves settings.py as raw text, it hands over SECRET_KEY and your database credentials. What the file leaks, why it forges sessions, and how to check.
The error log and access log in your web root are a replay of every request, tokens included
A downloadable error.log, access.log, or production.log replays your traffic: internal paths, stack traces, client IPs, and the tokens that rode in query strings. What server logs leak, and how to check.
Find it before someone else does.
Paste your domain. The grade and issue count are free, and you'll see in a couple of minutes exactly what's reachable from outside.
External, read-only scan. We only request public URLs - never log in, never send attack traffic.