SEC-014
Sensitive file publicly accessible
HighDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Database dumps, package-manager credentials, editor deploy configs and .DS_Store.
Why it matters
Backups and config files often contain customer data, tokens or server passwords.
Recommended fix
Delete these files from the public output and block the paths on the server.
How to verify
Request each listed path on the live site and confirm a 404.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-014: Sensitive file publicly accessible
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Remove the exposed file(s) listed in the evidence from the deployed public output, add them to .gitignore, and add a hosting rule that returns 404 for them. If any contained credentials or customer data, tell me which keys need rotating.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm a 404.