Sensitive File Exposure Scanner
Probes for exposed files like .env, .git, SSH keys or DB backups that leak secrets and code.
What it checks
This scanner probes well-known paths where files that should not be public often end up, such as .env, .git, SSH keys or database backups. It checks whether the server serves them instead of blocking them. It only verifies if they are reachable, without analyzing their contents.
Why it matters
These files usually hold secrets, credentials or your project's full source code. If they are downloadable, anyone can steal your keys or clone your application. It is one of the most severe leaks and one of the easiest for an attacker to exploit.
How to fix it
Never deploy these files to your production server: use deployment rules and a .gitignore that excludes them. Configure your server or host to block access to sensitive paths and extensions. If something already leaked, remove it immediately and rotate any keys that may have been exposed.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free