An internal configuration file is readable by anyone

What this means

A configuration file that belongs on the server is served to anyone who requests it — an environment file, a framework config, a package manifest or a deployment descriptor.

Why it matters

Configuration files routinely hold database addresses, access keys and internal service names. They are fetched automatically by scanners that try a few hundred well-known paths.

When this is not a problem

Some manifests are meant to be public — a web app manifest, for example. What matters is whether the file carries credentials or internal details.

Make sure configuration files are not served to the internet: block dotfiles
and known config paths at the web server, and keep configuration outside the
public web root.