Exposure
An internal configuration file is readable by anyone
Exposed configuration file
What this means
A configuration file that belongs on the server is served to anyone who requests it — an environment file, a framework config, a package manifest or a deployment descriptor.
Why it matters
Configuration files routinely hold database addresses, access keys and internal service names. They are fetched automatically by scanners that try a few hundred well-known paths.
When this is not a problem
Some manifests are meant to be public — a web app manifest, for example. What matters is whether the file carries credentials or internal details.
How to fix it
- Stop serving configuration files from the public web root.
- Rotate any credentials the exposed file contained — treat them as leaked.
- Block dotfiles and known config paths at the web server level.
Prompt for your AI agent
Make sure configuration files are not served to the internet: block dotfiles and known config paths at the web server, and keep configuration outside the public web root.
Verify the fix: request the file again — expect a refusal
Is your app doing this?
Find out in about a minute — the first scan is free.