Before writing a single line of exploit code, most attackers do something surprisingly mundane: they browse your web server looking for files you forgot to protect. Environment configs, database backups, version control metadata, and debug scripts are discovered every day on production servers — not through sophisticated exploitation but through simple HTTP requests to predictable paths. This guide explains what attackers look for, why these files are so dangerous, and how to ensure none of them are reachable on your site.
Why Sensitive File Exposure Is So Dangerous
Sensitive file exposure sits under OWASP A05: Security Misconfiguration — one of the most consistently prevalent categories in the OWASP Top 10. Unlike injection vulnerabilities that require crafted payloads, file exposure requires nothing more than knowing where to look. The files are already there; the attacker simply asks for them with a standard GET request.
The consequences vary by file type but are routinely severe:
- Environment files expose database passwords, API keys, and cloud credentials in plaintext
- Git metadata allows reconstruction of your entire source code from a production server
- Database backups hand an attacker a complete copy of your data without needing to touch the database server
- Log files reveal internal paths, error messages, user activity, and sometimes session tokens
- Debug and info scripts expose your server configuration, PHP version, loaded modules, and environment variables
The Files Attackers Probe First
Environment and Configuration Files
The .env file is the single most valuable target on a modern web application. Frameworks from Laravel to Next.js to Django conventionally store secrets here — database credentials, Stripe API keys, JWT secrets, mail server passwords. Finding a readable .env at https://yourdomain.com/.env is the equivalent of handing an attacker a master key. Other high-value config targets include config.php, settings.py, web.config, and application.yml.
Version Control Metadata
Deploying via git without removing the .git directory from the web root is a surprisingly common mistake. A readable .git/config file reveals repository remotes, usernames, and sometimes embedded credentials. A readable .git/HEAD confirms git is exposed. From there, tools exist to reconstruct the full repository object store — meaning your entire source code history is downloadable from your production server.
Database Backup Files
Database administrators routinely create backup files with extensions like .sql, .bak, .dump, or .db and place them temporarily in a web-accessible directory. When they forget to remove them — or when deployment scripts copy them along with application files — those backups become downloadable by anyone. A single backup.sql file can contain every user record, hashed password, and transaction in your database.
Log Files
Web servers and application frameworks generate logs continuously. When those logs land in a web-accessible directory, attackers gain a detailed view of your application's internals: error stack traces that reveal file paths and library versions, SQL query fragments from verbose logging, user email addresses, and sometimes session identifiers logged by mistake.
Development and Debug Scripts
Files like phpinfo.php, info.php, and test.php are created during development to verify server configuration. Left on production servers, they output a complete PHP environment dump — every loaded extension, every environment variable, every configuration directive. Similarly, wp-config.php on WordPress installations contains database credentials that should never be readable via HTTP under any circumstances.
How Shieldome Detects This
Shieldome probes 40+ sensitive paths on every scan, covering every major category of file exposure risk. The check is fully automated and requires no configuration — paste your domain, and Shieldome immediately begins requesting:
- Environment files:
.env,.env.local,.env.production,.env.backup - Git metadata:
.git/config,.git/HEAD,.git/COMMIT_EDITMSG - CMS configuration:
wp-config.php,configuration.php,LocalSettings.php - Database backups: files with
.sql,.bak,.dump, and.dbextensions under common names - Log files:
error.log,access.log,debug.log, and framework-specific log paths - Config files:
config.php,settings.py,web.config,app.config - Debug scripts:
phpinfo.php,test.php,info.php,setup.php
The detection rule is deliberately strict: any HTTP 200 response to a sensitive path is classified as a Critical severity finding. Shieldome flags it immediately, includes the full URL in the report, and maps the finding to OWASP A05 with remediation guidance.
How to Fix Sensitive File Exposure
- Never store secrets in the web root. Move
.envand config files above the document root, or use a secrets manager. - Block sensitive paths at the web server level. Use Nginx
locationblocks or Apache.htaccessrules to return 403 or 404 for.env,.git, and known backup extensions. - Audit your deployment pipeline. Ensure your CI/CD process does not copy hidden files or development artifacts to production.
- Delete debug scripts immediately after use.
phpinfo.phphas no place on a production server, ever. - Run backups to non-web-accessible storage. Write database dumps to a directory outside the document root, or directly to encrypted cloud storage.
Frequently Asked Questions
How do attackers find sensitive files without knowing my file names?
Attackers use wordlists containing hundreds of thousands of common file paths, configuration file names, backup naming conventions, and framework-specific paths. Tools like ffuf and dirsearch automate these requests at high speed. The file names Shieldome checks are drawn from the same sources attackers use — if Shieldome finds it, a motivated attacker will too.
Does my server returning a 403 Forbidden mean the file is safe?
A 403 response means the web server is blocking access, which is good — but it also confirms the file exists at that path. Some misconfigurations allow bypasses using encoded characters, trailing slashes, or alternative HTTP methods. A 404 response for sensitive paths (genuine or forced) is preferable to 403. Shieldome specifically looks for 200 responses indicating the file content is being served.
Is .git exposure really that serious if the repository is already public on GitHub?
If your repository is public and contains no secrets, direct git exposure is lower risk. However, production environments frequently contain secrets — injected via environment variables — that never appear in the repository. The .git directory on a production server may also contain commits with secrets that were removed from GitHub history but remain in the local object store. Regardless, serving .git from a production web root is never intentional and always warrants investigation.
Why would a database backup end up in my web root?
This happens more often than most teams expect. Developers running quick manual backups before migrations default to familiar directories. Automated scripts misconfigure output paths. Old deployment tarballs contain database seeds or fixture files with real data. Legacy hosting environments have document roots that overlap with directories developers treat as private. A regular automated scan catches these before attackers do.
How frequently does Shieldome check for new sensitive paths?
The sensitive path list in Shieldome is maintained and expanded as new framework conventions emerge, new CMS configurations become common, and new attack patterns are observed in the wild. Every scan you run uses the current full list — there is no need to manually update rules or signatures. Create a free Shieldome account and run your first scan in under two minutes.