Exposed Log Scanner

How this check works

Scanaris requests seven paths where the most common applications write their logs when nobody tells them otherwise: /debug.log, /error.log, /error_log, /laravel.log, /storage/logs/laravel.log, /npm-debug.log and /wp-content/debug.log. If any answers with a text file that looks like a log, and not with your site's generic page, it opens a medium-severity finding with the path. Logs rarely contain the whole database, which is why it is not critical; but few files say as much about how your site works inside.

Why it matters

An error log is a diary of everything that has failed: internal server paths, file and function names, exact library versions, database queries that failed with their parameters, user IP addresses, sometimes emails or tokens that appeared in a request. With that, someone looking for a vulnerability knows exactly where to look and which version to attack. And the log grows: every day it is exposed it tells more.

Why it happens

WordPress with WP_DEBUG_LOG enabled writes to wp-content/debug.log, which is a public folder; it is the most common case. Laravel keeps its logs in storage/logs, which should not be reachable, but is when the server points at the project root instead of public/. Apache on shared hosting leaves error_log next to the site files. And npm-debug.log appears when an install failed on the server and nobody cleaned up.

How to fix it

• WordPress: in production, define('WP_DEBUG', false); in wp-config.php. If you need the log temporarily, move it out of the public folder with define('WP_DEBUG_LOG', '/private/path/debug.log'); and delete the current file.
• Laravel: the web server must point at the project's public/ folder, never at the root. With that, storage/ stops being reachable. And APP_DEBUG=false.
• Node and others: write logs outside the served directory and ship them to a logging service if you can. Delete npm-debug.log and similar from the server.
• Block the extension on the server as a second barrier. In nginx: location ~* \.log$ { deny all; }. In Apache: <FilesMatch "\.log$"> Require all denied </FilesMatch>.
• Reduce what you log in production: error level instead of debug, no dumping full request bodies or tokens.

Check it is fixed

for p in debug.log error.log error_log laravel.log storage/logs/laravel.log npm-debug.log wp-content/debug.log; do
  printf "%-28s " "$p"; curl -s -o /dev/null -w "%{http_code}\n" "https://yourdomain.com/$p"
done

Expected: 404 or 403 on all of them. If your site is a single-page application and answers 200 with its HTML, it is not the log; open it to confirm.

Frequently asked questions

My log has nothing sensitive, just PHP notices.

Those notices include full server paths and plugin versions, which is exactly what an attacker uses to choose which exploit to try. And there is nothing sensitive today; tomorrow, with a new error, there may be.

Do I need to disable logging altogether?

No. You need it not to be public. Log whatever you want to a folder the web server does not serve, or to an external service.

Does this apply to me on Vercel or Netlify?

Almost never: there, logs are not written to public files, they are viewed in the dashboard. The finding shows up mostly on self-managed servers, WordPress and shared hosting.