Exposed sensitive filesWhat it checks and how to fix it

What it checks

Requests 24 well-known sensitive paths, including .env files, .git/config and .git/HEAD, .htpasswd, .aws/credentials, editor backups of config files, database.yml, SQL dumps, backup archives and dependency lockfiles. Any that answers 200 with a non-HTML content type fails (HTML responses are treated as a catch-all page, not the file). None exposed passes.

Why it matters

These files hold database passwords, API keys and cloud credentials, or, in the case of .git, the full source code and its history. Automated scanners request them on every site they find, within hours of it going live. One exposed .env file is usually enough for a full compromise.

How to fix it

First remove the files from the web root and rotate every secret they contained: assume they have already been downloaded. Then block these paths at the server so a future deploy cannot expose them again.

nginx

location ~ /\.(?!well-known) { deny all; return 404; }
location ~* \.(sql|bak|old|swp|tar\.gz|zip)$ { deny all; return 404; }
location ~* /(database\.yml|Gemfile\.lock|composer\.lock|package-lock\.json)$ { deny all; return 404; }

Apache

RedirectMatch 404 /\.(?!well-known)
<FilesMatch "\.(sql|bak|old|swp|zip)$|^(database\.yml|Gemfile\.lock|composer\.lock|package-lock\.json)$">
    Require all denied
</FilesMatch>

Cloudflare: Security → WAF → Custom rules → block when URI Path contains /.env, /.git/ or ends with .sql.

Rails: only public/ is served. Keep secrets in credentials or environment variables, never in public/, and check public/ for stray dumps or archives.